CVE-2026-42218: falha de média gravidade em neutrinolabs xrdp
XRDP is vulnerable to a server timing attack, leading to user enumeration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
neutrinolabs · xrdpCVEs relacionadas — neutrinolabs xrdp
No mesmo produto, das mais perigosas para as menos.
CVE-2020-4044HIGHLocal users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate itEPSS 2.3%CVE-2025-68670CRITICALxrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer OverflowEPSS 1.4%CVE-2026-41252CRITICALxrdp: lib_palette_update Heap Buffer Overflow & RCEEPSS 1.1%CVE-2022-23493CRITICALOut of Bound Read in xrdpEPSS 1.0%CVE-2022-23477CRITICALBuffer Overflow in xrdpEPSS 0.9%CVE-2022-23480CRITICALBuffer Overflow in xrdpEPSS 0.9%