CVE Watch22 jul 2026

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, wh

CVSS

5.3

Medio

EPSS

0.3%

p23

KEV

—

Exploit Today

0-100

Publicado: 20 jul 2026 · Última mod.: 22 jul 2026 · CWE-126

EPSS · 30d

0.3%EPSS · 30 días0.5%

2026-08-132026-09-09

Descripción técnica

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated attacker could potentially exploit this flaw by sending a specially crafted RDP packet containing malformed capability data. Due to missing bounds checks, the xrdp process may perform out-of-bounds memory reads, which can result in the termination of the service (Denial of Service). However, since xrdp forks a new process for each connection by default, an out-of-bounds read causing a process crash is unlikely to bring down the entire xrdp service. This issue has been fixed in version 0.10.6.1.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-76653—

—

———A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.8h CVE-2026-839515.5 MED

33.4%

——10Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.2d CVE-2026-839495.5 MED

33.4%

——10Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.2d CVE-2026-813995.5 MED

32.7%

——10Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.2d CVE-2026-785164.3 MED

42.0%

——13Buffer over-read in Windows Storage allows an unauthorized attacker to disclose information with a physical attack.14h CVE-2026-730296.5 MED

52.7%

——16Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.2d