xrdp Heap-Based Buffer Overflow Vulnerability in EGFX Implementation Allowing Remote Code Execution

A heap-based buffer overflow vulnerability has been identified in xrdp versions prior to 0.10.6. This issue resides in the EGFX (graphics dynamic virtual channel) implementation, where insufficient validation of client-controlled size parameters allows for out-of-bounds writes via crafted PDUs. Exploitation of this vulnerability can lead to process crashes or, in post-authentication scenarios, remote code execution. The vulnerability can be reproduced by sending specially crafted PDUs that exploit the lack of proper size validation, causing an out-of-bounds write that can be manipulated for code execution.

Impact

Successful exploitation of this vulnerability can cause process crashes or allow for remote code execution, depending on the authentication state.

Remediation

Users should update to xrdp version 0.10.6. If an immediate update is not possible, xrdp can be run as a non-privileged user to limit the impact of exploitation.