CVE-2026-32107

Name
CVE-2026-32107
Description
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6
security-advisories@github.com https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:* xrdp >= None < 0.10.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xrdp edge-community 0.10.6-r0 Will Sinatra <wpsinatra@gmail.com> fixed
xrdp edge-community 0.10.5-r1 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.5-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.4.1-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.4-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.3-r1 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.3-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.2-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.10.1-r1 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp edge-community 0.9.23.1-r0 Alan Lacerda <alacerda@alpinelinux.org> possibly vulnerable
xrdp edge-community 0.9.23-r0 Alan Lacerda <alacerda@alpinelinux.org> possibly vulnerable
xrdp edge-community 0.9.21.1-r0 Alan Lacerda <alacerda@alpinelinux.org> possibly vulnerable
xrdp edge-community 0.9.18.1-r0 Alan Lacerda <alacerda@alpinelinux.org> possibly vulnerable
xrdp edge-community 0.9.15-r1 Alan Lacerda <alacerda@alpinelinux.org> possibly vulnerable
xrdp edge-community 0.9.13.1-r0 None possibly vulnerable
xrdp 3.23-community 0.10.6-r0 Will Sinatra <wpsinatra@gmail.com> fixed
xrdp 3.23-community 0.10.5-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable
xrdp 3.23-community 0.10.4.1-r0 Will Sinatra <wpsinatra@gmail.com> possibly vulnerable