CVE-2026-55639: 
xrdp vulnerability analysis and mitigation

CVE-2026-55639 is an out-of-bounds read vulnerability in xrdp, an open-source RDP server, affecting versions 0.10.6 and prior. The flaw resides in the parsing of Client Security Data within the Client MCS Connect Initial PDU with GCC Conference Create Request during the RDP connection sequence. A remote, unauthenticated attacker can send a specially crafted RDP packet to trigger the parser to read a small number of bytes beyond the declared data block boundary, potentially disclosing process memory contents. The vulnerability was published on July 20, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read): during the initial capability and security negotiation phase of an RDP connection, the xrdp parser fails to perform sufficient length validation on the incoming Client Security Data block, allowing reads beyond the declared buffer boundary (GitHub Advisory). The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it automatable. The vulnerability is associated with CAPEC-540 (Overread Buffers) and was reported by researcher TristanInSec (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a low-level confidentiality impact — specifically, a small number of bytes of xrdp process memory may be disclosed to an unauthenticated remote attacker. There is no integrity or availability impact. While the direct memory leak is limited in scope, the advisory notes that the disclosed memory contents could potentially be combined with other vulnerabilities to achieve a more significant compromise (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-55639. The EPSS score is approximately 0.42%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" at this time, though the attack is automatable due to the lack of authentication or user interaction requirements (GitHub Advisory, Red Hat).

1. Reconnaissance: Identify internet-facing or network-accessible hosts running xrdp (default port 3389/TCP) using tools such as Shodan, Censys, or nmap, targeting versions 0.10.6 and prior.
2. Craft malicious RDP packet: Construct a Client MCS Connect Initial PDU with GCC Conference Create Request containing a malformed Client Security Data block where the declared length is shorter than the actual data, designed to trigger the out-of-bounds read in the xrdp parser.
3. Send crafted packet: Transmit the malformed RDP packet to the target xrdp server without any prior authentication or session establishment.
4. Observe memory disclosure: Capture the server's response, which may contain a small number of bytes of xrdp process memory beyond the intended buffer boundary.
5. Chain with other vulnerabilities: Use the disclosed memory contents (e.g., heap addresses, stack canaries) as an information leak to facilitate exploitation of additional vulnerabilities for further impact (GitHub Advisory).

• Network: Unusual or malformed RDP connection attempts (port 3389/TCP) from external or unexpected sources that do not complete a full authentication handshake; repeated connection attempts with non-standard Client MCS Connect Initial PDU structures.
• Logs: xrdp session logs showing connection attempts that terminate abnormally during the capability/security negotiation phase; error messages related to MCS data parsing from unauthenticated sources.
• Process: Unexpected memory read errors or crashes in the xrdp process during the initial connection sequence, potentially logged as segmentation faults or similar runtime errors.

The vulnerability is fixed in xrdp version 0.10.6.1, released on July 6, 2026, which addresses CVE-2026-55639 along with nine other CVEs (xrdp Release). Administrators should upgrade to version 0.10.6.1 or later as the primary remediation. As a temporary workaround where upgrading is not immediately possible, restrict access to the xrdp port (default 3389/TCP) using firewall rules to limit exposure to trusted networks or IP ranges only.

The vulnerability was assigned a "Moderate" severity rating by the xrdp project maintainers and was included in a batch security release fixing 10 CVEs (xrdp Release). Red Hat tracked the issue via Bugzilla and classified it as medium priority/severity (Red Hat Bugzilla). Fedora issued update advisories incorporating the patched xrdp version, and the fix was covered by Linux security news outlets including LinuxSecurity.com and pro-linux.de.