CVE-2025-68670 — Pre-Authentication Stack Buffer Overflow RCE in xrdp via Crafted Client Info PDU Domain String

CVE-2025-68670 (TL-2026-0484), also tracked as GHSA-rwvg-gp87-gh6f, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-05-08. It has no confirmed attribution, affects neutrinolabs xrdp, references 1 CVE (CVE-2025-68670), maps to 14 MITRE ATT&CK techniques (T1027, T1046, T1059), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0484

Threat ID
TL-2026-0484
Also known as
GHSA-rwvg-gp87-gh6f, DLA-4464-1, DSA-6123-1
Severity
CRITICAL
CVSS
9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-05-08
Last reviewed
2026-05-08
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, education, government, healthcare, financial-services, industrial-control-systems, retail, research, telecommunications, energy
Target regions
Global
Detection rules
9
Indicators of compromise
18

xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow (CWE-121 / CWE-787) in xrdp_wm_parse_domain_information() at xrdp/xrdp_login_wnd.c:306-360. A remote attacker sends a Client Info PDU whose domain string is prefixed with an underscore and contains multi-byte UTF-16 characters that, after UTF-16-to-UTF-8 conversion, exceed the 256-byte stack buffer. Discovered by Kaspersky researchers Denis Skvortsov and Dmitry Shmoylov during an audit of Kaspersky USB Redirector and disclosed publicly on Securelist on 2026-05-07; patched in xrdp v0.10.5 with backports to v0.9.27 and v0.10.4.1.

How CVE-2025-68670 works

CVE-2025-68670 is a pre-authentication, stack-based buffer overflow in xrdp — the open-source Linux implementation of Microsoft's Remote Desktop Protocol maintained by neutrinolabs. The flaw lives in xrdp_wm_parse_domain_information() in xrdp/xrdp_login_wnd.c (lines 306-360), the routine that parses the user-supplied domain field carried inside the RDP Client Info PDU during the connection-initialization phase, before any credentials are validated.

The function accepts a domain string up to 512 bytes and writes the parsed result into a 256-byte stack-allocated resultBuffer. When the input begins with an underscore ("_"), the routine treats everything between the leading underscore and a trailing double-underscore ("__") delimiter as content to copy into resultBuffer using g_strncpy(). The destination size was hard-coded to 256 with no awareness of the actual buffer capacity, and no validation that the parsed substring fit. A specially crafted payload in the form _<oversize>__<index> overflows the 256-byte stack frame, allowing an attacker to overwrite the saved frame pointer and return address.

Kaspersky's analysis notes that the practical exploitation primitive uses UTF-16-to-UTF-8 expansion: characters such as Cyrillic K (U+041A) and other code points in the BMP that occupy two UTF-8 bytes inflate the byte length on conversion, letting the attacker pack additional bytes past the 256-byte boundary while keeping the visible string short enough to traverse parsing. The published proof-of-concept payload illustrates the pattern "_veryveryveryverKKKKKKKK[…padding…]AAAAAAAA__0", where 0x41 bytes overwrite the saved RIP.

Compile-time stack canaries (-fstack-protector / -fstack-protector-strong) raise the bar but are explicitly not considered sufficient by the maintainers. Successful RCE additionally requires defeating the canary (information-leak side-channel, brute-force in forking-server scenarios, or canary-bypass primitives). ASLR and PIE can be defeated similarly through info leaks. The vulnerability runs in the xrdp daemon login window flow, which on most distributions executes as a service account with elevated privileges relative to a normal user; consequences range from service compromise to full host takeover depending on deployment.

The vulnerability was responsibly disclosed by Kaspersky's Denis Skvortsov (GitHub @the-deniss) and Dmitry Shmoylov via a GitHub Security Advisory on 2025-12-05 during a security assessment of Kaspersky USB Redirector and Kaspersky Thin Client, both of which embed xrdp. The neutrinolabs team acknowledged the report the same day, began investigation on 2025-12-15, started patch work on 2025-12-18, and merged commit 488c8c7d into main on 2026-01-27 alongside the v0.10.5 release. Backport releases v0.9.27 and v0.10.4.1 were published the same day. Debian shipped DLA-4464-1 for bullseye (xrdp 0.9.21.1-1~deb11u3) and DSA-6123-1 for bookworm/trixie shortly after. NVD assigned a primary CVSS v3.1 base score of 9.8 (CIA all High) on 2026-01-27, while the GitHub Security Advisory and vendor scoring is 9.1 (C:N, I:H, A:H). The threat is treated as CRITICAL across both scorings.

The patch (commit 488c8c7d4d189514a366cd8301b6e816c5218ffa) refactors xrdp_wm_parse_domain_information() to take an explicit unsigned int resultSize parameter, replaces the hard-coded g_memset(resultBuffer, 0, 256) with g_memset(resultBuffer, 0, resultSize), introduces an explicit (unsigned int)pos < resultSize bounds check before string operations, and replaces unsafe g_strncpy() calls with strlcpy() with proper size limits. All callers were updated to pass sizeof() of the destination buffer.

No in-the-wild exploitation has been publicly reported as of 2026-05-08, but the public Kaspersky write-up provides detailed technical specifics — including the payload structure, encoding trick, and stack-frame layout — that materially lower the cost of weaponization. The exposed attack surface is significant: xrdp is broadly deployed on internet-facing Linux jump hosts, lab/education systems, and embedded thin-client appliances. Kaspersky USB Redirector and Kaspersky Thin Client embed vulnerable xrdp builds and require their own vendor updates.

MITRE ATT&CK techniques used in TL-2026-0484

Defense Evasion

T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth

Discovery

T1046 Network Service Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1219 Remote Access Tools

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1499 Endpoint Denial of Service

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in CVE-2025-68670

  • neutrinolabs — xrdp
    Vulnerable versions: < 0.10.5; 0.9.x < 0.9.27; 0.10.x < 0.10.4.1
    Fixed in: 0.10.5; 0.9.27; 0.10.4.1
  • Debian — xrdp (bullseye / oldstable)
    Vulnerable versions: 0.9.21.1-1~deb11u1; 0.9.21.1-1~deb11u2
    Fixed in: 0.9.21.1-1~deb11u3
  • Debian — xrdp (bookworm / stable)
    Vulnerable versions: 0.9.21.1-1+deb12u1
    Fixed in: 0.9.21.1-1+deb12u2
  • Debian — xrdp (trixie)
    Vulnerable versions: 0.10.1-3; 0.10.1-3.1
    Fixed in: 0.10.1-3.1+deb13u1
  • Debian — xrdp (sid / unstable)
    Vulnerable versions: < 0.10.5
    Fixed in: 0.10.6-3
  • Kaspersky — USB Redirector
    Vulnerable versions: builds embedding xrdp < 0.10.5
    Fixed in: vendor-supplied update
  • Kaspersky — Thin Client
    Vulnerable versions: builds embedding xrdp < 0.10.5
    Fixed in: vendor-supplied update

Remediation for CVE-2025-68670

Patches

  • xrdp v0.10.5 (upstream main, released 2026-01-27)
  • xrdp v0.9.27 (backport, released 2026-01-27)
  • xrdp v0.10.4.1 (backport, released 2026-01-27)
  • Debian bullseye: xrdp 0.9.21.1-1~deb11u3 (DLA-4464-1)
  • Debian bookworm: xrdp 0.9.21.1-1+deb12u2 (DSA-6123-1)
  • Debian trixie: xrdp 0.10.1-3.1+deb13u1 (DSA-6123-1)
  • Debian sid: xrdp 0.10.6-3
  • Apply Kaspersky vendor patches for USB Redirector and Thin Client products

Immediate actions

  • Upgrade xrdp to v0.10.5 (main) or backport release v0.9.27 / v0.10.4.1 immediately
  • Block TCP/3389 at the network perimeter for any xrdp host that does not strictly require Internet exposure
  • Restrict xrdp access to VPN-only or trusted-source IP ranges via iptables/nftables host firewall
  • Audit Kaspersky USB Redirector and Kaspersky Thin Client deployments for embedded vulnerable xrdp builds and apply Kaspersky vendor patches
  • Identify all xrdp instances exposed to untrusted networks via asset inventory and external attack-surface scanning

Workarounds

  • Stop and disable xrdp until patched: systemctl stop xrdp && systemctl disable xrdp
  • Block TCP/3389 inbound at the host firewall: iptables -I INPUT -p tcp --dport 3389 -j DROP
  • Restrict xrdp source IPs via host firewall to a known management subnet only
  • Tunnel all RDP through a VPN with multi-factor authentication and mandatory access policy
  • Verify stack canary protection at runtime: xrdp -v | grep -E 'Stack|Canary' (defense-in-depth only — not sufficient on its own)

Longer-term hardening

  • Place all RDP services behind a zero-trust access broker, bastion, or identity-aware proxy — never expose xrdp directly to the Internet
  • Subscribe to Debian/Ubuntu/RHEL/SUSE security tracker feeds and configure unattended-upgrades for xrdp
  • Deploy network IDS signatures (Suricata/Snort/Zeek) that inspect TPKT/MCS-CONNECT-INITIAL Client Info PDUs for malformed/oversized domain fields
  • Enforce compile-time hardening for xrdp builds: -fstack-protector-strong, -D_FORTIFY_SOURCE=2, full RELRO, PIE, ASLR — and verify with checksec
  • Monitor xrdp daemon for unexpected child processes (shell spawns, network beacons) using EDR/auditd

CVEs associated with CVE-2025-68670

CVE-2025-68670

Weaknesses (CWE) in CVE-2025-68670

CWE-121, CWE-787

Timeline of CVE-2025-68670

  • Denis Skvortsov (Kaspersky, GitHub @the-deniss) and Dmitry Shmoylov privately report the vulnerability to neutrinolabs via GitHub Security Advisory; xrdp maintainers acknowledge receipt the same day.
  • neutrinolabs maintainers begin investigation of the buffer overflow in xrdp_wm_parse_domain_information() at xrdp/xrdp_login_wnd.c:306-360.
  • Patch development initiated upstream — refactoring the function to take a resultSize parameter and replacing g_strncpy with strlcpy.
  • MITRE assigns CVE-2025-68670 for the unauthenticated stack-based buffer overflow in xrdp.
  • Fix commit 488c8c7d4d189514a366cd8301b6e816c5218ffa merged to main; xrdp v0.10.5 released alongside backports v0.9.27 and v0.10.4.1; GitHub Security Advisory GHSA-rwvg-gp87-gh6f published; NVD record published with CVSS v3.1 base 9.8 (NVD primary) / 9.1 (vendor).
  • Debian publishes DLA-4464-1 (bullseye 0.9.21.1-1~deb11u3) and DSA-6123-1 (bookworm 0.9.21.1-1+deb12u2 / trixie 0.10.1-3.1+deb13u1); NVD record last-modified date.
  • Kaspersky publishes detailed technical analysis on Securelist with proof-of-concept payload structure (_<oversize>__<index>) and UTF-16-to-UTF-8 expansion exploitation primitive — materially lowers weaponization cost.
  • Threadlinqs Intelligence publishes full TL-2026-0484 intelligence package with detection content, simulation library, and remediation guidance.
  • As of 2026-05-29, CVE-2025-68670 remains fully patched (xrdp v0.10.5 + backports 0.9.27/0.10.4.1, plus Debian/Ubuntu/SUSE/Fedora/Mageia updates) with no confirmed in-the-wild exploitation, not in CISA KEV, and EPSS only ~0.17%. Only a Kaspersky demonstration PoC exists; weaponization cost is lowered by the public writeup, but the threat is neutralized for patched systems.

Sources cited for CVE-2025-68670

Threats related to CVE-2025-68670

Detection coverage for TL-2026-0484

As of 2026-05-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0484 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats