CVE-2026-32107
High · 8.8CVSS
8.8
EPSS
0.2%
Published
Apr 17, 2026
CISA due date
—
The record
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | xrdp | 0 | 0.9.27-2.1 |
Related vulnerabilities
- CVE-2026-35512 xrdp is an open source RDP server. Also affects xrdp
- CVE-2026-33145 xrdp is an open source RDP server. Also affects xrdp
- CVE-2026-33689 xrdp is an open source RDP server. Also affects xrdp
- CVE-2026-32624 xrdp is an open source RDP server. Also affects xrdp
- CVE-2026-32105 xrdp is an open source RDP server. Also affects xrdp
- CVE-2026-32623 xrdp is an open source RDP server. Also affects xrdp
- CVE-2025-68670 xrdp is an open source RDP server. Also affects xrdp
- CVE-2017-16927 The scp_v0s_accept function in sesman/libscp/libscp_v0.c in the session manager in xrdp… Also affects xrdp