CVE-2026-33689

xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service's memory space. This issue has been fixed in version 0.10.6.

• CWE-125

• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6Patch, Release Notes
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-92mr-6wpp-27jjVendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33683WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-33684WWBN AVideo is an open source video platform. Prior to versi…5.3
• CVE-2026-33685WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33686Sharp is a content management framework built for Laravel as…8.8
• CVE-2026-33687Sharp is a content management framework built for Laravel as…8.8
• CVE-2026-33688WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-3369The Better Find and Replace – AI-Powered Suggestions plugin …5.4
• CVE-2026-33690WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33691The OWASP core rule set (CRS) is a set of generic attack det…7.5
• CVE-2026-33692WWBN AVideo is an open source video platform. Versions prior…7.5
• CVE-2026-33693Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-33694This vulnerability allows an attacker to create a junction, …7.8