Loading story…
Two high-severity vulnerabilities were disclosed in xrdp affecting versions through 0.10.5, exposing both remote session integrity and local privilege boundaries. CVE-2026-32105 allows an unauthenticated attacker with man-in-the-middle capability to alter encrypted RDP traffic without detection because xrdp does not verify the MAC signature on received packets when the Classic RDP Security layer is used. The flaw does not affect deployments that enforce TLS, and administrators unable to upgrade immediately were advised to set:
security_layer=tls
A second flaw, CVE-2026-32107, affects xrdp's session execution component and can let an authenticated local attacker gain root privileges if the privilege-drop operation fails and child processes continue executing with elevated rights. The issue requires local access and an additional exploit path, but it can lead to arbitrary code execution with full system impact. Both vulnerabilities were fixed in xrdp 0.10.6, making upgrade the primary remediation for exposed servers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Public advisories described two xrdp flaws: CVE-2026-32105, where MAC signatures on received encrypted RDP packets were not verified in non-TLS mode, and CVE-2026-32107, where sesexec child processes could continue with root privileges if setuid failed. Both disclosures stated the issues affected xrdp versions through 0.10.5 and were fixed in 0.10.6.
xrdp released version 0.10.6 to fix CVE-2026-32105, an integrity bypass in non-TLS Classic RDP Security mode, and CVE-2026-32107, a fail-open privilege drop flaw in sesexec that could let a local authenticated attacker gain root. Systems unable to upgrade were advised to enforce TLS to mitigate CVE-2026-32105.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky disclosed **CVE-2025-68670**, a pre-authentication remote code execution flaw in the open-source **xrdp** server, after finding the issue during a security audit of Kaspersky USB Redirector. The vulnerability stems from improper handling of the RDP domain field: xrdp converts client-supplied UTF-16 data to UTF-8 and then copies attacker-controlled domain input into a **256-byte stack buffer** without sufficient bounds checking, creating a stack-based buffer overflow that can be triggered before authentication. Kaspersky said it reported the bug to the xrdp maintainers in December 2025, and the project has since released fixes in **xrdp 0.10.5** and backported patches to **0.9.27** and **0.10.4.1**, alongside a security bulletin. The disclosure notes that while stack canaries may complicate straightforward exploitation, they are not a complete mitigation, and organizations running exposed or internally reachable xrdp services should prioritize upgrading to patched versions.
Jun 29, 2026
Microsoft released fixes for two **Windows Remote Desktop Protocol (RDP)** information disclosure vulnerabilities, `CVE-2026-42908` and `CVE-2026-45639`, that allow a remote, unauthenticated attacker to trigger out-of-bounds reads and expose sensitive memory without user interaction. According to reporting on the June 9, 2026 security updates, `CVE-2026-42908` can disclose local memory addresses and weaken **ASLR**, while `CVE-2026-45639` can reveal process memory including credentials, session tokens, and protocol state data. Microsoft rated both flaws **Important** with **CVSS 7.5** and said exploitation was considered less likely at release, with no public exploits reported. The vulnerabilities affect a broad set of Windows platforms, including **Windows 10**, **Windows 11**, **Windows Server 2012 through 2025**, and Microsoft’s Remote Desktop client offerings for Windows desktop. The disclosures arrive amid continued scrutiny of the RDP ecosystem after earlier reports of severe Remote Desktop weaknesses, including `CVE-2025-29967` in **RD Gateway** and `CVE-2025-29966` and `CVE-2025-48817` in the **Windows Remote Desktop Client**, which were described as enabling remote code execution through heap overflow or path traversal conditions. Organizations were urged to prioritize patching internet-exposed RDP systems and strengthen access controls with VPNs, bastion hosts, strong authentication, and monitoring.
Jun 29, 2026
Microsoft disclosed and patched several **remote code execution** vulnerabilities affecting Windows Remote Desktop components, including **Remote Desktop Services** flaws tracked as `CVE-2025-21309`, `CVE-2025-24045`, and `CVE-2024-49123`. The issues were published through the Microsoft Security Response Center update guide and indicate continued security exposure in services commonly used for remote administration and application access across Windows environments. Microsoft also published a related **Windows Remote Desktop Licensing Service** remote code execution vulnerability, `CVE-2024-38263`, expanding the affected surface beyond core Remote Desktop Services. The cluster of advisories highlights the need for organizations to prioritize patching internet-exposed and internally accessible RDS infrastructure, review segmentation around remote access systems, and verify that all Windows servers running Remote Desktop roles and licensing components have the latest security updates applied.
Jul 12, 2026