CVE-2022-23482

CRITICAL 9.1CVE-2022-23482 · Published 09/12/2022 · updated 17/06/2026

In short

CVE-2022-23482 is a CRITICAL (CVSS 9.1) vulnerability affecting xrdp (neutrinolabs).
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.5% of all vulnerabilities.
Fix: update to 0.9.21 or later.

Package	Affected versions	Patched versions
xrdp neutrinolabs	`< 0.9.21`	`0.9.21`

Description

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_sec_process_mcs_data_CS_CORE() function. There are no known workarounds for this issue. Users are advised to upgrade.

References

neutrinolabs/xrdp security advisory · Third Party Advisory
debian.org/security/2023/dsa-5502 · Third Party Advisory

More vulnerabilities in xrdp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

xrdp

neutrinolabs

< 0.9.21

0.9.21

More vulnerabilities in xrdp

See all →