CVE-2026-32105
Description
A flaw was found in xrdp, an open-source Remote Desktop Protocol (RDP) server. When using the "Classic RDP Security" layer, xrdp fails to verify the Message Authentication Code (MAC) signature of encrypted RDP packets. This oversight allows an unauthenticated attacker with man-in-the-middle (MITM) capabilities to modify encrypted traffic as it travels between the client and server without being detected, compromising data integrity. This vulnerability does not affect connections where the Transport Layer Security (TLS) security layer is enforced.
Statement
This vulnerability in xrdp compromises data integrity when the "Classic RDP Security" layer is in use, allowing an unauthenticated man-in-the-middle attacker to modify encrypted RDP traffic without detection. Connections configured to enforce the TLS security layer are not affected by this flaw.
This vulnerability doesn't affect any supported Red Hat products.
Mitigation
Configure xrdp to enforce TLS security. Edit `/etc/xrdp/xrdp.ini` and set `security_layer=tls` in the `[Globals]` section. A restart of the xrdp service is required for the changes to take effect.
Understanding the Weakness (CWE)
Access Control,Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands
An attacker could gain access to sensitive data and possibly execute unauthorized code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
