# cve.now: Neutrinolabs

The newest entries naming Neutrinolabs as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55639](https://cve.now/CVE-2026-55639.md): xrdp: Out-of-bounds read in GCC Conference Create Request CS\_SECURITY processing (xrdp\_sec\_process\_mcs\_data\_CS\_SECURITY) (CVSS 5.3)
- [CVE-2026-55626](https://cve.now/CVE-2026-55626.md): xrdp: No authentication required with Xvnc backend on RHEL 9 (CVSS 8.0)
- [CVE-2026-55238](https://cve.now/CVE-2026-55238.md): xrdp: Malformed Confirm Active capability sets cause out-of-bounds reads (CVSS 5.3)
- [CVE-2026-54538](https://cve.now/CVE-2026-54538.md): xrdp: Pre-auth infinite loop via totalLength=0 in TS\_SHARECONTROLHEADER (CVSS 7.5)
- [CVE-2026-44978](https://cve.now/CVE-2026-44978.md): xrdp: Unchecked FIPS padding length in standard RDP Security causes heap out-of-bounds read in HMAC verification (CVSS 5.3)
- [CVE-2026-44178](https://cve.now/CVE-2026-44178.md): xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow (CVSS 8.8)
- [CVE-2026-55645](https://cve.now/CVE-2026-55645.md): xrdp: Out-of-bounds read in Client Control PDU processing (xrdp\_rdp\_process\_data\_control) (CVSS 6.5)
- [CVE-2026-42218](https://cve.now/CVE-2026-42218.md): XRDP is vulnerable to a server timing attack, leading to user enumeration (CVSS 5.3)
- [CVE-2026-41521](https://cve.now/CVE-2026-41521.md): xrdp: lib\_framebuffer\_update Has Integer Overflow Heap Info Leak & ASLR Bypass (CVSS 8.2)
- [CVE-2026-41252](https://cve.now/CVE-2026-41252.md): xrdp: lib\_palette\_update Heap Buffer Overflow & RCE (CVSS 9.8)
- [CVE-2026-35512](https://cve.now/CVE-2026-35512.md): xrdp: Heap buffer overflow in EGFX channel (CVSS 8.7)
- [CVE-2026-33689](https://cve.now/CVE-2026-33689.md): xrdp: Pre-authentication out-of-bounds reads in channel parsers (CVSS 8.7)
- [CVE-2026-33145](https://cve.now/CVE-2026-33145.md): xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman (CVSS 6.3)
- [CVE-2026-32624](https://cve.now/CVE-2026-32624.md): xrdp: Heap buffer overflow in xrdp\_sec\_process\_logon\_info() via incorrect g\_strncat length calculation (CVSS 6.3)
- [CVE-2026-33516](https://cve.now/CVE-2026-33516.md): xrdp: Pre-authentication out-of-bounds reads in RDP capability and channel parsers (CVSS 7.7)
- [CVE-2026-32623](https://cve.now/CVE-2026-32623.md): xrdp: Heap buffer overflow in NeutrinoRDP channel reassembly (CVSS 7.7)
- [CVE-2026-32105](https://cve.now/CVE-2026-32105.md): xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode (CVSS 9.3)
- [CVE-2026-32107](https://cve.now/CVE-2026-32107.md): xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails (CVSS 8.8)
- [CVE-2025-68670](https://cve.now/CVE-2025-68670.md): xrdp improperly checks bounds of domain string length, which leads to Stack-based Buffer Overflow (CVSS 9.1)
- [CVE-2024-39917](https://cve.now/CVE-2024-39917.md): xrdp allows an ininite number of login attempts (CVSS 7.2)
- [CVE-2023-42822](https://cve.now/CVE-2023-42822.md): Unchecked access to font glyph info in xrdp (CVSS 4.6)
- [CVE-2023-40184](https://cve.now/CVE-2023-40184.md): Improper handling of session establishment errors in xrdp (CVSS 2.6)
- [CVE-2022-23477](https://cve.now/CVE-2022-23477.md): Buffer Overflow in xrdp (CVSS 9.1)
- [CVE-2022-23484](https://cve.now/CVE-2022-23484.md): Integer Overflow in xrdp (CVSS 8.2)
- [CVE-2022-23483](https://cve.now/CVE-2022-23483.md): Out-of-Bound Read in libxrdp (CVSS 7.5)
- [CVE-2022-23482](https://cve.now/CVE-2022-23482.md): Out-of-Bound Read in xrdp (CVSS 0.0)
- [CVE-2022-23481](https://cve.now/CVE-2022-23481.md): Out-of-Bound Read in xrdp (CVSS 0.0)
- [CVE-2022-23480](https://cve.now/CVE-2022-23480.md): Buffer Overflow in xrdp (CVSS 9.1)
- [CVE-2022-23479](https://cve.now/CVE-2022-23479.md): Buffer Overflow occurs in xrdp (CVSS 9.1)
- [CVE-2022-23478](https://cve.now/CVE-2022-23478.md): Out of Bound Write in xrdp (CVSS 9.1)
- [CVE-2022-23468](https://cve.now/CVE-2022-23468.md): Buffer Overflow in xrdp (CVSS 6.5)
- [CVE-2022-23493](https://cve.now/CVE-2022-23493.md): Out of Bound Read in xrdp (CVSS 9.1)
- [CVE-2022-23613](https://cve.now/CVE-2022-23613.md): Privilege escalation on xrdp (CVSS 7.8)
- [CVE-2020-4044](https://cve.now/CVE-2020-4044.md): Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/neutrinolabs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.