PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44978 neutrinolabs CVE debrief

CVE-2026-44978 is a heap out-of-bounds read vulnerability within the FIPS-specific receive paths of xrdp, an open-source RDP server. The vulnerability exists in versions 0.10.6 and prior. It is not exploitable in the default configuration of xrdp. The vulnerability is only exploitable when the security layer is set to security_layer=negotiate or security_layer=rdp, and the crypto level is changed to crypt_level=fips in xrdp.ini. In this specific non-default mode, the server fails to validate the FIPS padding length field, leading to a pointer underflow and a subsequent negative length calculation. An unauthenticated remote attacker can exploit this by sending a crafted FIPS-protected PDU, causing a heap out-of-bounds read that results in a process crash and denial of service (DoS). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service.

Vendor
neutrinolabs
Product
xrdp
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Users of xrdp versions 0.10.6 and prior who have configured the security layer to security_layer=negotiate or security_layer=rdp and the crypto level to crypt_level=fips in xrdp.ini should be aware of this vulnerability. System administrators and security teams responsible for managing and securing RDP servers should assess the risk and apply mitigations.

Technical summary

The vulnerability is caused by the server's failure to validate the FIPS padding length field in a specific non-default configuration. This leads to a pointer underflow and a negative length calculation when an attacker sends a crafted FIPS-protected PDU. The vulnerability results in a heap out-of-bounds read, causing a process crash and denial of service (DoS). The default configuration of xrdp is not affected as it forks a new process for each connection.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, especially for systems configured with FIPS mode. System administrators should review their xrdp configurations and update to version 0.10.6.1 or later.

Recommended defensive actions

  • Review and update xrdp to version 0.10.6.1 or later.
  • Check if the xrdp configuration uses FIPS mode and adjust settings as necessary.
  • Monitor xrdp logs for potential exploitation attempts.
  • Implement additional security measures such as network segmentation and access controls.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-20T17:17:09.370Z and was last modified on 2026-07-22T20:08:31.313Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T17:17:09.370Z and has not been modified since then. The NVD entry is currently Analyzed.