Bug#1126537: xrdp: CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1126537: xrdp: CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow
Date	2026-01-28 11:50 +0100
Message-ID	<Mibhv-dW3W-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: xrdp
Version: 0.10.1-3.1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for xrdp.

CVE-2025-68670[0]:
| xrdp is an open source RDP server. xrdp before v0.10.5 contains an
| unauthenticated stack-based buffer overflow vulnerability. The issue
| stems from improper bounds checking when processing user domain
| information during the connection sequence. If exploited, the
| vulnerability could allow remote attackers to execute arbitrary code
| on the target system. The vulnerability allows an attacker to
| overwrite the stack buffer and the return address, which could
| theoretically be used to redirect the execution flow. The impact of
| this vulnerability is lessened if a compiler flag has been used to
| build the xrdp executable with stack canary protection. If this is
| the case, a second vulnerability would need to be used to leak the
| stack canary value. Upgrade to version 0.10.5 to receive a patch.
| Additionally, do not rely on stack canary protection on production
| systems.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-68670
    https://www.cve.org/CVERecord?id=CVE-2025-68670
[1] https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f
[2] https://github.com/neutrinolabs/xrdp/commit/0d6964415ac31f8240ed894de1ff626bf4683eac (v0.10.5)

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1126537: xrdp: CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow Salvatore Bonaccorso <carnil@debian.org> - 2026-01-28 11:50 +0100
  Processed: xrdp: diff for NMU version 0.10.1-4.1 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-01-31 21:40 +0100
  Bug#1126537: xrdp: diff for NMU version 0.10.1-4.1 Salvatore Bonaccorso <carnil@debian.org> - 2026-01-31 21:40 +0100
  Bug#1126537: marked as done (xrdp: CVE-2025-68670: Improper  bounds checking of domain string length leads to Stack-based Buffer  Overflow) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-02-01 17:50 +0100
  Bug#1126537: marked as done (xrdp: CVE-2025-68670: Improper  bounds checking of domain string length leads to Stack-based Buffer  Overflow) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-02-02 11:40 +0100
  Bug#1126537: marked as done (xrdp: CVE-2025-68670: Improper  bounds checking of domain string length leads to Stack-based Buffer  Overflow) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-02-08 13:50 +0100
  Bug#1126537: marked as done (xrdp: CVE-2025-68670: Improper  bounds checking of domain string length leads to Stack-based Buffer  Overflow) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-02-08 13:50 +0100

csiph-web