CVE-2025-68670 is a critical stack based buffer overflow (CVSS 9.1) in xrdp, the open source RDP server. It happens while the server processes user domain information during connection setup, before login. Upgrade to xrdp 0.10.5, and do not rely on stack canaries as protection.
What's affected
- xrdp before 0.10.5.
- Fixed version: 0.10.5.
- Debian Linux is listed as an affected product, and a Debian LTS announcement is referenced for packaged updates.
How to check if you're exposed
Check the installed xrdp version:
xrdp --version
On Debian and Ubuntu you can also read the package version:
dpkg -l xrdp
Package maintainers may backport the fix without changing the upstream version number, so for a distribution package, compare against the distribution's own security notice, such as the Debian LTS announcement for this issue. Also check whether TCP port 3389 is open to networks you do not control.
What to do now
- Find every host running xrdp, including remote desktop servers set up for convenience.
- Upgrade to xrdp 0.10.5, or install your distribution's fixed package.
- Restrict port 3389 to a VPN or trusted address ranges with the host firewall.
- Do not assume stack canary builds are safe. The advisory says not to rely on them on production systems.
- Review authentication logs for odd connection attempts before login.
- Restart the xrdp service after upgrading and confirm the new version.
If staff need remote desktop access, a VPN or a gateway that requires multi factor authentication in front of xrdp removes direct exposure of the service. Pair that with the upgrade. Exposure, not only the version, decides how soon an attacker could reach the vulnerable code.
Why it matters
The record maps this to CWE-121, a stack based buffer overflow, and CWE-787, an out of bounds write. The server copies the domain field from a connection request into a fixed size buffer without checking its length, so oversized input overwrites neighbouring memory, including the return address.
Because this happens early in the connection sequence, no valid account is needed. The advisory notes that stack canary protection lessens the impact, since a second flaw would be needed to leak the canary value, but it tells operators not to depend on that.
Remote desktop services are a frequent target because they give a direct path to a machine. The record does not list this CVE as exploited in the wild, which is a reason to patch calmly, not to wait.
Memory safety bugs like this one appear in network services written in C. They are fixed one at a time, and there will be more. Reducing exposure matters as much as patching: put remote desktop behind a VPN, limit source addresses at the firewall, and turn on multi factor authentication at the gateway.
Compiler hardening such as stack canaries, address space layout randomisation and non executable stacks raises the cost of an attack, but the advisory is explicit that you should not depend on it. Treat those as a second line.
If xrdp comes from a distribution package, subscribe to that distribution's security announcements, since package maintainers often backport fixes.
Quick check
Do stack canaries make CVE-2025-68670 safe?
They lessen the impact, but the advisory says not to rely on them on production systems. Upgrade to 0.10.5.
Sources
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f
- https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.5
- https://lists.debian.org/debian-lts-announce/2026/02/msg00003.html
Last reviewed: 19 October 2026.
