Pre-Login Takeover Flaw in Linux Remote Desktop 'xrdp': 10 Flaws Fixed at Once (CVE-2026-41252), Update to 0.10.6.1

xrdp, the popular software that lets you connect to a Linux PC using Windows' "Remote Desktop," has a worst-tier flaw that can be exploited to take over the machine before anyone even logs in. The developers released a fix, xrdp 0.10.6.1, on July 7, 2026, which patches a total of 10 flaws including this one.

The most serious is CVE-2026-41252, with a danger score of 9.8 out of 10, exploitable without even entering a password. If you expose xrdp to the internet so people can reach a Linux desktop remotely, you need to update soon. Here is what can happen, how dangerous it is, and how to fix it on each Linux distribution.

Overview of the flaws

Here are the two with the greatest impact. Both are fixed in 0.10.6.1, and all earlier versions (0.10.6 and before) are affected.

"Remote takeover" means the attacker can run a program of their choosing on that server (technically, arbitrary code execution). CVE-2026-41252 stands out because, under the right conditions, it succeeds before authentication—hence the high 9.8 score.

What is xrdp, exactly?

xrdp is open-source software that lets you log into a Linux or UNIX-style PC from Windows' built-in "Remote Desktop Connection." Because it points the same native connection screen you'd use between Windows machines at a Linux box, it is widely used to reach in-house Linux servers and development machines remotely.

One of the features at issue is "vnc-any mode." This setting lets xrdp bridge (relay) a connection it receives onward to another screen-sharing (VNC) server. Structurally, it is the same family as the flaw we covered earlier in "LibVNC, where merely connecting to a malicious VNC server can lead to takeover": the connecting side trusts the data sent by the destination too much. As a screen-sharing software flaw, it also echoes the series of vulnerabilities found in UltraVNC.

Who targets this, and what they do

The people who go after this hole are attackers scanning the internet for reachable xrdp servers. Remote Desktop endpoints are often exposed to the net in a findable way, and mechanically scanning to list vulnerable targets is a daily occurrence.

In the most dangerous case, CVE-2026-41252, the attacker sets up a deliberately crafted "malicious VNC server," gets xrdp to relay to it, and feeds in corrupted data. Because xrdp processes that data without adequately checking its size, its internal memory overflows and, if it works, the attacker's program starts running on the server. The frightening part is that all of this can happen before login.

If the damage becomes real, you first lose control of that Linux machine. Files and credentials stored on it can be stolen, and it can be turned into a foothold into the internal network. If it runs as a service, everyone who relies on that function is suddenly unable to connect, and the operators are left chasing the cause and restoring it. The first step is to check whether you have any internet-facing xrdp.

CVE-2026-41252: the worst-tier flaw that lands before login

According to the developers' security advisory (GHSA-w5vg-6qmv-j63j), the flaw is in the part that processes the color map data sent from the relayed VNC server while xrdp runs in "vnc-any mode." When an attacker sends a crafted message containing out-of-range values, xrdp writes beyond the memory region it had reserved, corrupting an area called the heap (a heap-based buffer overflow).

The advisory describes the impact as potentially leading to "denial of service, or remote code execution, prior to authentication." That exploitation needs no login is the reason for the high 9.8 score. As a mitigation, the developers recommend disabling the [vnc-any] section in the xrdp.ini configuration file outside of test use. If you can't update immediately, reviewing that setting is a stopgap.

CVE-2026-44178: the virtual-channel flaw targeted after login

The other flaw, CVE-2026-44178 (GHSA-hh7r-2rmq-q4g4), is in the handling of "virtual channels"—the communication paths that, separately from the screen display, carry things like file transfer and clipboard sharing. When a logged-in user (or an attacker who has gained such privileges) sends a message that exceeds the fixed size, memory is again corrupted, potentially leading to a service outage or code execution with xrdp's privileges.

Because exploitation requires login, the danger score is a notch lower at 8.8, but since a single hijacked legitimate account can be used as a stepping stone, it can't be left alone. It is a variety of the same heap-based buffer overflow as CVE-2026-41252.

Other flaws fixed in 0.10.6.1

Beyond the two above, 0.10.6.1 fixes several more flaws. Many lead to service outages (DoS) or information reads, and they are published in the developers' list of security advisories. Here are the main ones.

Severity varies flaw by flaw, but since they are all fixed together, moving to 0.10.6.1 addresses them in one go. GHSA-m3xx-cpc4-982r (missing authentication when launching Xvnc) is listed as requiring no authentication, so it, too, shouldn't be overlooked.

How to update on each Linux

On most Linux systems, xrdp is installed via the OS's standard software distribution mechanism (packages), so the fix ships as each Linux distribution's security update, rolled out in turn. The basic move is to bring your own xrdp up to date.

Timing differs by distribution. For Ubuntu, check USN-8476-1; for Debian, the package tracker page. If you install from source, update to 0.10.6.1 or later from the GitHub releases.

What to check right now

• Review your exposure: Check whether the xrdp endpoint (port 3389 by default) is directly exposed to the internet. Limiting it to your internal network or a VPN alone greatly lowers the risk of being hit before authentication.
• If you can't update now, use a config stopgap: The most dangerous CVE-2026-41252 enters through the relay feature. If you don't use [vnc-any] in xrdp.ini, disable it.
• Check your version: If your installed xrdp is 0.10.6 or earlier, you're affected. After updating, confirm you're on 0.10.6.1 or later.
• Don't forget to restart: After updating, restart the xrdp service, or the old program may keep running.

Summary

xrdp 0.10.6.1 is an important update that fixes 10 flaws at once, including CVE-2026-41252, which can lead all the way to remote takeover before login. There are no reports of exploitation in the wild at this point, but Remote Desktop endpoints are inherently attractive targets, and a flaw that succeeds before authentication is especially dangerous.

The fix is simple: update to 0.10.6.1 or later. If you can't upgrade right away, reviewing your exposure and disabling the relay feature keeps the risk in check for now. We will update this article as follow-ups or distribution rollouts develop.

Sources

• ▸ NVD - CVE-2026-41252
• ▸ xrdp Security Advisory GHSA-w5vg-6qmv-j63j (heap-based buffer overflow in vnc-any mode)
• ▸ NVD - CVE-2026-44178
• ▸ xrdp Security Advisory GHSA-hh7r-2rmq-q4g4 (heap-based buffer overflow in virtual channel forwarding)
• ▸ xrdp security advisories (GitHub)
• ▸ neutrinolabs/xrdp releases (0.10.6.1)
• ▸ Ubuntu Security Notice USN-8476-1: xrdp vulnerabilities
• ▸ Debian Package Tracker - xrdp