An unauthenticated, remote heap-based buffer overflow in xrdp allows attackers to crash the service or potentially gain code execution.

The vulnerability is caused by a missing bounds check on RFB protocol color map messages when xrdp is operating in vnc-any mode. An attacker can supply malformed data to trigger an out-of-bounds write on the heap, leading to service disruption or arbitrary code execution.

This flaw carries a CVSS score of 9.8, reflecting its potential for total system compromise via remote code execution. If exploited, an attacker could gain unauthorized control over the server, leading to severe data breaches or complete infrastructure takeover, especially in environments where xrdp is exposed to the internet.

Immediate Action: Update xrdp to version 0.10.6.1 or later to resolve the memory corruption issue.

Proactive Monitoring: Review system logs for unusual xrdp process behavior and monitor for patterns of malformed RFB traffic.

Compensating Controls: If upgrading is not immediately possible, disable vnc-any mode or restrict access to the xrdp service using firewall rules to limit exposure.

Public Exploit Available: Unknown

Administrators must treat this vulnerability with the highest urgency due to its potential for remote code execution. Applying the update to version 0.10.6.1 is the only reliable method to mitigate the risk of memory corruption and unauthorized access.