{"id":"CVE-2025-68670","aliases":["ALPINE-CVE-2025-68670","DEBIAN-CVE-2025-68670","DLA-4464-1","DSA-6123-1","EUVD-2025-206388","GHSA-rwvg-gp87-gh6f","MGASA-2026-0037","SUSE-SU-2026:0404-1","SUSE-SU-2026:0433-1","SUSE-SU-2026:0477-1","UBUNTU-CVE-2025-68670","USN-8476-1","openSUSE-SU-2026:10146-1","openSUSE-SU-2026:20167-1"],"status":"published","title":"xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0137,"percentile":0.72115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2026-01-27T15:52:41Z","modified":"2026-11-03T06:33:01Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"xrdp","fixed_in":["0.10.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xrdp","fixed_in":["0.10.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xrdp","fixed_in":["0.9.21.1-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xrdp","fixed_in":["0.10.1-3.1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xrdp","fixed_in":["0.10.1-4.1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"xrdp","fixed_in":["0.9.21.1-1~deb11u3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xrdp","fixed_in":["0.9.23.1-1.2.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xrdp","fixed_in":["0.9.10-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xrdp","fixed_in":["0.9.10-3.22.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xrdp","fixed_in":["0.9.13.1-150600.15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150600.15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xrdp","fixed_in":["0.9.13.1-150600.15.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"xrdp","fixed_in":["0.9.13.1-150600.15.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xrdp","fixed_in":["0.9.13.1-150200.4.36.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","fixed_in":["0.9.5-2ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","fixed_in":["0.9.12-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","fixed_in":["0.9.17-2ubuntu3+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","fixed_in":["0.9.24-4ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"xrdp","fixed_in":["0.10.1-3.1+deb13u1build0.25.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xrdp","fixed_in":["0.9.27-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"xrdp","fixed_in":["0.9.26-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1+deb12u2"}]}],"versions":["0.9.21.1-1","0.9.21.1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1"}]}],"versions":["0.10.1-3.1"]},{"source":"osv","ecosystem":"Debian:14","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-4.1"}]}],"versions":["0.10.1-3.1","0.10.1-4"]},{"source":"osv","ecosystem":"Debian:11","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1~deb11u3"}]}],"versions":["0.9.12-1.1","0.9.15-1","0.9.17-1","0.9.17-2","0.9.17-2.1","0.9.19-1","0.9.21.1-1~deb11u1","0.9.21.1-1~deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.21.1-1+deb12u2"}]}],"versions":["0.9.21.1-1","0.9.21.1-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1"}]}],"versions":["0.10.1-3.1"]},{"source":"osv","ecosystem":"Mageia:9","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.23.1-1.2.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10-3.22.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150600.15.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13.1-150200.4.36.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm3"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm2"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu3+esm2"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1build0.25.10.1"}]}],"versions":["0.10.1-3","0.10.1-3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.5-2ubuntu0.1~esm3"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.12-1ubuntu0.1+esm2"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.17-2ubuntu3+esm2"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.24-4ubuntu0.1~esm1"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-3.1+deb13u1build0.25.10.1"}]}],"versions":["0.10.1-3","0.10.1-3.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.27-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.26-bp160.2.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"neutrinolabs","product":"xrdp"}],"references":[{"url":"https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/neutrinolabs/xrdp/commit/488c8c7d4d189514a366cd8301b6e816c5218ffa","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.5","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/02/msg00003.html","tags":["Mailing List","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-68670","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68670.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68670","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68670","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0037.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35111","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00032.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260404-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257362","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68670","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260433-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260477-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-68670","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68670","tags":["report"]},{"url":"https://github.com/neutrinolabs/xrdp/commit/0d6964415ac31f8240ed894de1ff626bf4683eac","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-39917","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68670","title":"xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T15:52:41.052Z","modified":"2026-02-03T01:34:11.878Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-206388","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T15:52:41Z","modified":"2026-02-03T01:34:11Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:45.084164Z"}],"nvd":[{"id":"CVE-2025-68670","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T16:16:16.037Z","modified":"2026-06-17T09:59:24.63Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"ALPINE-CVE-2025-68670","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T16:16:16.037Z","modified":"2026-11-03T06:33:01.06398608Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-68670","title":"xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T15:52:41.052Z","modified":"2026-10-28T02:30:21.890594708Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68670","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T16:16:16.037Z","modified":"2026-09-01T20:05:57.415788583Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"UBUNTU-CVE-2025-68670","description":"xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system. The vulnerability allows an attacker to overwrite the stack buffer and the return address, which could theoretically be used to redirect the execution flow. The impact of this vulnerability is lessened if a compiler flag has been used to build the xrdp executable with stack canary protection. If this is the case, a second vulnerability would need to be used to leak the stack canary value. Upgrade to version 0.10.5 to receive a patch. Additionally, do not rely on stack canary protection on production systems.","status":"published","published":"2026-01-27T16:16:00Z","modified":"2026-06-25T23:45:10.359714405Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"DLA-4464-1","title":"xrdp - security update","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-02-03T01:30:04.281785Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6123-1","title":"xrdp - security update","status":"published","published":"2026-02-07T00:00:00Z","modified":"2026-02-07T07:30:05.653055Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0037","title":"Updated xrdp packages fix security vulnerability","description":"xrdp improperly checks bounds of domain string length, which leads to\nStack-based Buffer Overflow. (CVE-2025-68670)\n","status":"published","published":"2026-02-11T17:56:31Z","modified":"2026-04-16T04:42:56.449938813Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10146-1","title":"libpainter0-0.9.27-1.1 on GA media","description":"These are all security issues fixed in the libpainter0-0.9.27-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-04T00:00:00Z","modified":"2026-03-23T04:54:30.350184Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20167-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\nChanges in xrdp:\n\n- CVE-2025-68670: Fixed a potential overflow (bsc#1257362).\n","status":"published","published":"2026-02-03T15:00:07Z","modified":"2026-03-23T04:54:46.299408Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0404-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)\n","status":"published","published":"2026-02-06T16:58:44Z","modified":"2026-03-23T04:52:12.774434Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0433-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)\n","status":"published","published":"2026-02-11T09:13:53Z","modified":"2026-03-23T04:52:14.258386Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0477-1","title":"Security update for xrdp","description":"This update for xrdp fixes the following issues:\n\n- CVE-2025-68670: Fix a potential overflow when processing user domain information. (bsc#1257362)\n","status":"published","published":"2026-02-12T11:45:18Z","modified":"2026-03-23T04:52:16.727084Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"USN-8476-1","title":"xrdp vulnerabilities","description":"It was discovered that xrdp incorrectly handled bounds checking when\nprocessing user domain information during the connection sequence. An\nunauthenticated remote attacker could use this issue to cause xrdp to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-68670)\n\nIt was discovered that xrdp did not correctly enforce the maximum number of\nlogin attempts configured by the MaxLoginRetry parameter. A remote attacker\ncould use this issue to perform an unlimited number of login attempts.\n(CVE-2024-39917)\n\nIt was discovered that xrdp did not perform bounds checking when accessing\nfont glyphs. Since some of this data is controllable by the user, a remote\nattacker could use this issue to cause xrdp to read out of bounds. This\nissue only affected Ubuntu 24.04 LTS. (CVE-2023-42822)\n\nIt was discovered that xrdp did not properly handle session establishment\nerrors. A remote attacker could use this issue to bypass OS-level session\nrestrictions enforced by PAM, such as the maximum number of concurrent\nsessions per user. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2023-40184)","status":"published","published":"2026-06-25T14:47:42Z","modified":"2026-06-25T23:59:17.105152448Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}