CVE-2022-23613

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.

• CWE-191
• CWE-191

• https://github.com/neutrinolabs/xrdp/commit/4def30ab8ea445cdc06832a44c3ec40a506a0ffaPatch, Third Party Advisory
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5ONRGARKHGFU2CIEQ7E6M6VJZEM5XWW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3XGFJNQMNXHBD3J7CBM4YURYEDXROWZ/
• https://github.com/neutrinolabs/xrdp/commit/4def30ab8ea445cdc06832a44c3ec40a506a0ffaPatch, Third Party Advisory
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8h98-h426-xf32Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K5ONRGARKHGFU2CIEQ7E6M6VJZEM5XWW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3XGFJNQMNXHBD3J7CBM4YURYEDXROWZ/

Published

Feb 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23608PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-23609iTunesRPC-Remastered is a Discord Rich Presence for iTunes o…9.1
• CVE-2022-2361The WP Social Chat WordPress plugin before 6.0.5 does not sa…4.8
• CVE-2022-23610wire-server provides back end services for Wire, an open sou…8.1
• CVE-2022-23611iTunesRPC-Remastered is a Discord Rich Presence for iTunes o…9.8
• CVE-2022-23612OpenMRS is a patient-based medical record system focusing on…7.5
• CVE-2022-23614Twig is an open source template language for PHP. When in a …9.8
• CVE-2022-23615XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2022-23616XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2022-23617XWiki Platform is a generic wiki platform offering runtime s…6.5
• CVE-2022-23618XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2022-23619XWiki Platform is a generic wiki platform offering runtime s…7.5