CVE-2026-41521

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a denial of service (DoS) via a process crash. This issue has been fixed in version 0.10.6.1.

• CWE-190

• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1Release Notes
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-v8w6-pf78-9458Mitigation, Vendor Advisory

Published

Jul 20, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41516OP-TEE is a Trusted Execution Environment (TEE) designed as …3.3
• CVE-2026-41517Emlog is an open source website building system. Prior to ve…0
• CVE-2026-41518Chartbrew is an open-source web application that can connect…7.6
• CVE-2026-41519Weblate is a web based localization tool. Prior to version 5…5.4
• CVE-2026-4152GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code…7.8
• CVE-2026-41520Cilium is a networking, observability, and security solution…4.4
• CVE-2026-41522Iris is a web collaborative platform that helps incident res…7.1
• CVE-2026-41523vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-41524Brave CMS is an open-source CMS. Prior to commit 6c56603, pa…8.7
• CVE-2026-41525KDE Dolphin before 25.12.3 allows applications in a Flatpak …6.5
• CVE-2026-41526In KDE KCoreAddons before 6.25, KShell::quoteArgs is intende…7.8
• CVE-2026-41527KDE Kleopatra before 26.08.0 on Windows allows local users t…6.9