CVE-2026-41521 is a high severity integer overflow (CVSS 8.2) in xrdp, the open source RDP server. In version 0.10.6 and earlier, the vnc-any connection mode can be fed crafted image dimensions by a malicious VNC server. Upgrade to 0.10.6.1, or disable the mode.
What's affected
Per the GitHub advisory, xrdp up to and including 0.10.6 is affected and 0.10.6.1 is patched. Only the vnc-any connection mode is involved. The record says a malicious remote VNC server can send crafted image dimensions that make a buffer size calculation overflow, producing an undersized allocation, and later an out-of-bounds read when the image data arrives.
How to check if you're exposed
Check the version:
xrdp --version
Then see whether the vnc-any section is enabled in the config file, usually /etc/xrdp/xrdp.ini:
grep -n -A6 "vnc-any" /etc/xrdp/xrdp.ini
The advisory also says to look for other custom sections that allow connections to arbitrary VNC hosts, such as ones using lib=libvnc.so with ip=ask. If none of these exists, the exposure to this bug is far lower.
For container images, check what xrdp version is baked in. A container scan can list it.
What to do now
- Upgrade xrdp to 0.10.6.1 or later.
- Follow the advisory's mitigation: remove or comment out the
[vnc-any]section fromxrdp.ini. - Remove any other custom section that lets users connect to arbitrary VNC hosts.
- Restart xrdp after changing the configuration.
- Allow letting users choose the target VNC host only in test or other non-production setups, after careful thought, as the advisory states.
Why it matters
The record lists CWE-190, integer overflow or wraparound. The size of a buffer is computed from width and height. If the multiplication wraps, the buffer is too small, but the code still processes the data with the original large values, and reads beyond the allocation.
The advisory describes impact as disclosure of heap memory or a crash. The vector shows no privileges and no user interaction, so the key defense is configuration: do not let the server connect to hosts the user picks. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
We never set up vnc-any. Are we exposed?
The advisory ties the flaw to that mode and similar arbitrary VNC host sections. If none is enabled, you are much less exposed, but upgrading is still the right fix.
Sources
Last reviewed: 19 October 2026.
