CVE-2025-68670
xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
CVE-2025-68670- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2025-206388
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
EUVD-2025-206388- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
NVD
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
CVE-2025-68670- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-68670
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
ALPINE-CVE-2025-68670- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
CVE-2025-68670- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-68670
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
DEBIAN-CVE-2025-68670- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2025-68670
xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.
- Record
UBUNTU-CVE-2025-68670- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0037 No score
Updated xrdp packages fix security vulnerability
xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow. (CVE-2025-68670)
- Record
MGASA-2026-0037- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10146-1 No score
libpainter0-0.9.27-1.1 on GA media
These are all security issues fixed in the libpainter0-0.9.27-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10146-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20167-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
Changes in xrdp:
- CVE-2025-68670: Fixed a potential overflow (bsc#1257362).
- Record
openSUSE-SU-2026:20167-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0404-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)
- Record
SUSE-SU-2026:0404-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0433-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)
- Record
SUSE-SU-2026:0433-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0477-1 No score
Security update for xrdp
This update for xrdp fixes the following issues:
- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)
- Record
SUSE-SU-2026:0477-1- Updated
- 2026-11-02
OSVUSN-8476-1 No score
xrdp vulnerabilities
It was discovered that xrdp incorrectly handled bounds checking when processing user domain information during the connection sequence. An unauthenticated remote attacker could use this issue to cause xrdp to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-68670)
It was discovered that xrdp did not correctly enforce the maximum number of login attempts configured by the MaxLoginRetry parameter. A remote attacker could use this issue to perform an unlimited number of login attempts. (CVE-2024-39917)
It was discovered that xrdp did not perform bounds checking when accessing font glyphs. Since some of this data is controllable by the user, a remote attacker could use this issue to cause xrdp to read out of bounds. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)
It was discovered that xrdp did not properly handle session establishment errors. A remote attacker could use this issue to bypass OS-level session restrictions enforced by PAM, such as the maximum number of concurrent sessions per user. This issue only affected Ubuntu 24.04 LTS. (CVE-2023-40184)
- Record
USN-8476-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xrdpAlpine:v3.23 |
before 0.10.5-r0 | 0.10.5-r0 |
xrdpAlpine:v3.24 |
before 0.10.5-r0 | 0.10.5-r0 |
xrdpDebian:12 |
before 0.9.21.1-1+deb12u2, plus listed versions 0.9.21.1-10.9.21.1-1+deb12u1 |
0.9.21.1-1+deb12u2 |
xrdpDebian:13 |
before 0.10.1-3.1+deb13u1, plus listed versions 0.10.1-3.1 |
0.10.1-3.1+deb13u1 |
xrdpDebian:14 |
before 0.10.1-4.1, plus listed versions 0.10.1-3.10.10.1-4 |
0.10.1-4.1 |
xrdpDebian:11 |
before 0.9.21.1-1~deb11u3, plus listed versions 0.9.12-1.10.9.15-10.9.17-10.9.17-20.9.17-2.10.9.19-10.9.21.1-1~deb11u10.9.21.1-1~deb11u2 |
0.9.21.1-1~deb11u3 |
xrdpMageia:9 |
before 0.9.23.1-1.2.mga9 | 0.9.23.1-1.2.mga9 |
xrdpSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 0.9.10-3.22.1 | 0.9.10-3.22.1 |
xrdpSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 0.9.10-3.22.1 | 0.9.10-3.22.1 |
xrdpSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 0.9.13.1-150600.15.6.1 | 0.9.13.1-150600.15.6.1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xrdpSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 0.9.13.1-150600.15.6.1 | 0.9.13.1-150600.15.6.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 0.9.13.1-150600.15.6.1 | 0.9.13.1-150600.15.6.1 |
xrdpopenSUSE:Leap 15.6 |
before 0.9.13.1-150600.15.6.1 | 0.9.13.1-150600.15.6.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 0.9.13.1-150200.4.36.1 | 0.9.13.1-150200.4.36.1 |
xrdpUbuntu:Pro:18.04:LTS |
before 0.9.5-2ubuntu0.1~esm3, plus listed versions 0.9.1-90.9.4-10.9.4-20.9.4-30.9.4-4 Show 6 moreShow less0.9.4-50.9.5-10.9.5-1build10.9.5-20.9.5-2ubuntu0.1~esm10.9.5-2ubuntu0.1~esm2 |
0.9.5-2ubuntu0.1~esm3 |
xrdpUbuntu:Pro:20.04:LTS |
before 0.9.12-1ubuntu0.1+esm2, plus listed versions 0.9.9-10.9.12-10.9.12-1ubuntu0.10.9.12-1ubuntu0.1+esm1 |
0.9.12-1ubuntu0.1+esm2 |
xrdpUbuntu:Pro:22.04:LTS |
before 0.9.17-2ubuntu3+esm2, plus listed versions 0.9.15-1ubuntu10.9.17-10.9.17-20.9.17-2ubuntu10.9.17-2ubuntu20.9.17-2ubuntu2+esm10.9.17-2ubuntu30.9.17-2ubuntu3+esm1 |
0.9.17-2ubuntu3+esm2 |
xrdpUbuntu:Pro:24.04:LTS |
before 0.9.24-4ubuntu0.1~esm1, plus listed versions 0.9.21.1-10.9.24-20.9.24-30.9.24-3build10.9.24-3build20.9.24-4 |
0.9.24-4ubuntu0.1~esm1 |
xrdpUbuntu:25.10 |
before 0.10.1-3.1+deb13u1build0.25.10.1, plus listed versions 0.10.1-30.10.1-3.1 |
0.10.1-3.1+deb13u1build0.25.10.1 |
xrdpUbuntu:Pro:18.04:LTS From an advisory covering 4 CVEs |
before 0.9.5-2ubuntu0.1~esm3, plus listed versions 0.9.1-90.9.4-10.9.4-20.9.4-30.9.4-4 Show 6 moreShow less0.9.4-50.9.5-10.9.5-1build10.9.5-20.9.5-2ubuntu0.1~esm10.9.5-2ubuntu0.1~esm2 |
0.9.5-2ubuntu0.1~esm3 |
xrdpUbuntu:Pro:20.04:LTS From an advisory covering 4 CVEs |
before 0.9.12-1ubuntu0.1+esm2, plus listed versions 0.9.9-10.9.12-10.9.12-1ubuntu0.10.9.12-1ubuntu0.1+esm1 |
0.9.12-1ubuntu0.1+esm2 |
xrdpUbuntu:Pro:22.04:LTS From an advisory covering 4 CVEs |
before 0.9.17-2ubuntu3+esm2, plus listed versions 0.9.15-1ubuntu10.9.17-10.9.17-20.9.17-2ubuntu10.9.17-2ubuntu20.9.17-2ubuntu2+esm10.9.17-2ubuntu30.9.17-2ubuntu3+esm1 |
0.9.17-2ubuntu3+esm2 |
xrdpUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 0.9.24-4ubuntu0.1~esm1, plus listed versions 0.9.21.1-10.9.24-20.9.24-30.9.24-3build10.9.24-3build20.9.24-4 |
0.9.24-4ubuntu0.1~esm1 |
xrdpUbuntu:25.10 From an advisory covering 4 CVEs |
before 0.10.1-3.1+deb13u1build0.25.10.1, plus listed versions 0.10.1-30.10.1-3.1 |
0.10.1-3.1+deb13u1build0.25.10.1 |
xrdpopenSUSE:Tumbleweed |
before 0.9.27-1.1 | 0.9.27-1.1 |
xrdpopenSUSE:Leap 16.0 |
before 0.9.26-bp160.2.1 | 0.9.26-bp160.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-68670 is a critical vulnerability (CVSS 9.1) in Neutrinolabs Xrdp, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in xrdp 0.10.5-r0.
References
github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f
lists.debian.org/debian-lts-announce/2026/02/msg00003.html
security.alpinelinux.org/vuln/CVE-2025-68670
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-68670
security-tracker.debian.org/tracker/CVE-2025-68670
advisories.mageia.org/MGASA-2026-0037.html
bugs.mageia.org/show_bug.cgi?id=35111
suse.com/support/update/announcement/2026/suse-su-20260404-1
bugzilla.suse.com/1257362
ubuntu.com/security/CVE-2025-68670
cve.org/CVERecord?id=CVE-2025-68670