Back Linuxsecurity

Fedora 42 xrdp Critical Stack Overflow Fix 2026-b409dad73e

Linuxsecurity • February 8, 2026

xrdp provides a fully functional RDP server compatible with a wide range of RDP clients, including FreeRDP and Microsoft RDP client. Update Information : Release notes for xrdp v0.10.5 (2026/01/27) Security fixes CVE-2025-68670: Improper bounds checking of domain string length leads to Stack- based Buffer Overflow New features It is now possible to start the xrdp daemon entirely unprivileged from the service manager (#3599 #3603). If you do this certain restrictions will apply. See root for details. TLS pre-master secrets can now be recorded for packet captures (#3617) Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers (#3639) Alternate shell names can now be passed to startwm.sh in an environment variable for more system management control (#3624 #3651) Updated Xorg paths in sesman.ini to include more recent distros (#3663) Add Slovenian keyboard (#3668 #3670) xrdpapi: Add a way to monitor connect/disconnect events (#3693) Bug fixes Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #35...

xrdp provides a fully functional RDP server compatible with a wide range

of RDP clients, including FreeRDP and Microsoft RDP client.

Release notes for xrdp v0.10.5 (2026/01/27) Security fixes CVE-2025-68670: Improper bounds checking of domain string length leads to Stack- based Buffer Overflow New features It is now possible to start the xrdp daemon entirely unprivileged from the service manager (#3599 #3603). If you do this certain restrictions will apply. See root for details. TLS pre-master secrets can now be recorded for packet captures (#3617) Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers (#3639) Alternate shell names can now be passed to startwm.sh in an environment variable for more system management control (#3624 #3651) Updated Xorg paths in sesman.ini to include more recent distros (#3663) Add Slovenian keyboard (#3668 #3670) xrdpapi: Add a way to monitor connect/disconnect events (#3693) Bug fixes Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #35...

* Wed Jan 28 2026 Bojan Smojver - 1:0.10.5-1 - Update to 0.10.5 * Sat Jan 17 2026 Fedora Release Engineering - 1:0.10.4-5 - Rebuilt for * Tue Nov 4 2025 Tom Callaway - 1:0.10.4-4 - rebuild for new fuse3 * Fri Jul 25 2025 Fedora Release Engineering - 1:0.10.4-3 - Rebuilt for

[ 1 ] Bug #1908387 - Windows with transparency show whatever is below [ 2 ] Bug #2279775 - xrdp socketdir not cleaned up on package removal [ 3 ] Bug #2322105 - AltGr on Spanish keyboards [ 4 ] Bug #2323097 - Requesting clarification on the License of xrdp rpm. [ 5 ] Bug #2433438 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8] [ 6 ] Bug #2433439 - CVE-2025-68670 xrdp: xrdp: Remote code execution via unauthenticated stack-based buffer overflow [epel-8] [ 7 ] Bug #2433440 - CVE-2025-68670 xorgxrdp: xrdp: Remote code execution via unauthenticat... Read the Full Advisory

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b409dad73e' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 xrdp Vulnerability CVE-2025-68670 Affects Multiple Users A critical stack-based buffer overflow vulnerability, CVE-2025-68670, was identified in xrdp, affecting users of Fedora 43. This vulnerability arises from improper bounds checking of domain string length, which could lead to exploitation. The issue was addressed in the release notes for xrdp version 0.10.5, published on January 27, 2026. 3 sources 31

Extracted Entities

Fedora 42 xrdp Critical Stack Overflow Fix 2026-b409dad73e

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (1)