CVE-2026-42218

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

5.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N                                    

Vulnerability Description

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.

Vulnerability Details

Published Date

July 20, 2026

Last Modified

July 20, 2026

CWE ID

CWE-204

Source

NVD

Vendor

neutrinolabs

Product

xrdp

External References

https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-3wr5-fwmh-qh34

CVE-2026-42218

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment