CVE-2026-32105

The vulnerability results from incomplete implementation of the integrity control mechanism (CWE-354): the sending side correctly generates an 8-byte integrity signature, however the receiving side lacks logic to verify this signature — it is silently ignored. An attacker positioned between the client and server (MITM) can therefore arbitrarily modify encrypted RDP packets during transmission, without risk of detection by the server. The vulnerability does not affect connections where the TLS security layer is enforced.

An attacker in a MITM position can manipulate RDP traffic in a manner undetected by the server, which may lead to compromise of session integrity and potential takeover of the connection. Confidentiality of transmitted data is not directly threatened, however the integrity of transmission — both on the client side and third-party side — is seriously compromised.

Xrdp should be updated to version 0.10.6, where the issue has been fixed. If immediate update is not possible, as a workaround, the TLS layer should be enforced in the xrdp.ini configuration file (parameter: security_layer=tls), which will ensure end-to-end connection integrity.

Neutrinolabs Xrdp in versions 0.10.5 and earlier, using the 'Classic RDP Security' security layer. Connections using the TLS layer are not vulnerable.