CVE-2026-33689 is an out of bounds read in the pre-authentication message parsing of xrdp, the open source RDP server. NVD scores it 9.1. A remote, unauthenticated attacker can crash the service or possibly read memory. Upgrade to xrdp 0.10.6.
What's affected
The record says xrdp versions through 0.10.5 are affected and 0.10.6 fixes the issue. The GitHub advisory lists affected versions as below 0.10.6 and the patched version as 0.10.6, and describes the bug as pre-authentication out of bounds reads in the dynamic channel parser. The release date for 0.10.6 is 17 April 2026 per the release notes.
How to check if you're exposed
xrdp --version
Anything below 0.10.6 is affected. Also check where the service listens, since the attack needs network access to the RDP port:
ss -ltnp | grep xrdp
If port 3389 is reachable from the internet or from untrusted networks, exposure is higher. Distribution packages often backport fixes under the old version number, so check your vendor's advisory if your package manager shows an older version.
What to do now
- Upgrade xrdp to 0.10.6 or later, or apply your distribution's fixed package.
- Restrict access to the RDP port with a firewall or VPN so only known networks can reach it.
- Watch for xrdp crashes and restarts in your service logs, which could indicate probing.
- Add xrdp to your software inventory so future advisories map to the right hosts.
Why it matters
The record files this under CWE-125, out of bounds read. The advisory says the cause is insufficient validation of input buffer lengths before dynamic channel data is processed. Because it happens before login, no credentials are needed.
The impact named is denial of service through a process crash, or disclosure of data from the service's memory. A remote desktop server is often a high value host, so even a read bug deserves a fast patch. The record is not marked as exploited in the wild and is not in the CISA KEV catalog.
Quick check
Do attackers need a valid login?
No. The flaw is in the initial connection phase, before authentication.
Sources
Last reviewed: 19 October 2026.
