CVE-2026-33516 is a critical (CVSS 9.1) out-of-bounds read in xrdp, the open source RDP server. A crafted Confirm Active PDU sent before login can crash the process or expose memory. Versions through 0.10.5 are affected, and the fix is xrdp 0.10.6, so upgrade.
What's affected
- Product: xrdp (neutrinolabs).
- Affected: versions through 0.10.5.
- Fixed: 0.10.6.
- Exposure: any xrdp service reachable by a remote client, since no authentication is needed.
How to check if you're exposed
xrdp --version
dpkg -l xrdp
rpm -q xrdp
Use whichever matches your system. Also confirm whether TCP port 3389 is reachable from untrusted networks.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether xrdp is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- Upgrade xrdp to 0.10.6 or later through your package manager or from the project release.
- Restrict port 3389 to a VPN or a known address range.
- Watch for xrdp crashes or restarts, which can signal probing.
- The advisory lists no workaround other than upgrading.
Why it matters
During the RDP capability exchange, xrdp reads memory before it checks how many bytes remain in the buffer. A short or crafted Confirm Active PDU makes it read beyond the end of the data. That is CWE-125, out-of-bounds read. The result is a crash, or in some cases disclosure of data from process memory.
Because the packet arrives before login, any host that can reach the port can try it. That is why exposure of port 3389 matters as much as the version number: a remote desktop service on the internet gets probed constantly, and a crash takes remote access away from your users until the service restarts. A memory disclosure is harder to spot because nothing visibly fails, so patching is the safer course than waiting for symptoms. This CVE is not in the CISA KEV catalog.
Quick check
Do attackers need an account to trigger CVE-2026-33516?
No. The advisory describes a remote, unauthenticated attacker sending a crafted Confirm Active PDU.
Sources
- https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rvh9-9wm3-28c7
- https://nvd.nist.gov/vuln/detail/CVE-2026-33516
Last reviewed: 19 October 2026.
