8.8 CVE-2026-32107

Enriched by CISA Patch
 

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
https://nvd.nist.gov/vuln/detail/CVE-2026-32107

Categories

CWE-273 : Improper Check for Dropped Privileges
If the drop fails, the product will continue to run with the raised privileges, which might provide additional access to unprivileged users.

References


 

AFFECTED (from MITRE)

Vendor Product Versions
neutrinolabs xrdp
  • < 0.10.6 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe start end
Configuration 1
cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:* < 0.10.6

REMEDIATION

Patch

Url
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6

EXPLOITS

Exploit-db.com

id description date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
No known exploits

CAPEC

Common Attack Pattern Enumerations and Classifications

id description severity
No entry