# CVE-2025-68670 — Pre-Authentication Stack Buffer Overflow RCE in xrdp via Crafted Client Info PDU Domain String

> xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow (CWE-121 / CWE-787) in xrdp_wm_parse_domain_information() at xrdp/xrdp_login_wnd.c:306-360. A remote attacker sends a Client Info PDU whose domain string is prefixed with an underscore and contains multi-byte UTF-16 characters that, after UTF-16-to-UTF-8 conversion, exceed the 256-byte stack buffer. Discovered by Kaspersky researchers Denis Skvortsov and Dmitry Shmoylov during an audit of Kaspersky USB Redirector and disclosed publicly on Securelist on 2026-05-07; patched in xrdp v0.10.5 with backports to v0.9.27 and v0.10.4.1.

- **Published:** 2026-05-08T12:00:00Z
- **Last reviewed:** 2026-05-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0484
- **ID:** TL-2026-0484
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-68670

## Description

CVE-2025-68670 is a pre-authentication, stack-based buffer overflow in xrdp — the open-source Linux implementation of Microsoft's Remote Desktop Protocol maintained by neutrinolabs. The flaw lives in xrdp_wm_parse_domain_information() in xrdp/xrdp_login_wnd.c (lines 306-360), the routine that parses the user-supplied domain field carried inside the RDP Client Info PDU during the connection-initialization phase, before any credentials are validated.

The function accepts a domain string up to 512 bytes and writes the parsed result into a 256-byte stack-allocated resultBuffer. When the input begins with an underscore ("_"), the routine treats everything between the leading underscore and a trailing double-underscore ("__") delimiter as content to copy into resultBuffer using g_strncpy(). The destination size was hard-coded to 256 with no awareness of the actual buffer capacity, and no validation that the parsed substring fit. A specially crafted payload in the form _<oversize>__<index> overflows the 256-byte stack frame, allowing an attacker to overwrite the saved frame pointer and return address.

Kaspersky's analysis notes that the practical exploitation primitive uses UTF-16-to-UTF-8 expansion: characters such as Cyrillic K (U+041A) and other code points in the BMP that occupy two UTF-8 bytes inflate the byte length on conversion, letting the attacker pack additional bytes past the 256-byte boundary while keeping the visible string short enough to traverse parsing. The published proof-of-concept payload illustrates the pattern "_veryveryveryverKKKKKKKK[…padding…]AAAAAAAA__0", where 0x41 bytes overwrite the saved RIP.

Compile-time stack canaries (-fstack-protector / -fstack-protector-strong) raise the bar but are explicitly not considered sufficient by the maintainers. Successful RCE additionally requires defeating the canary (information-leak side-channel, brute-force in forking-server scenarios, or canary-bypass primitives). ASLR and PIE can be defeated similarly through info leaks. The vulnerability runs in the xrdp daemon login window flow, which on most distributions executes as a service account with elevated privileges relative to a normal user; consequences range from service compromise to full host takeover depending on deployment.

The vulnerability was responsibly disclosed by Kaspersky's Denis Skvortsov (GitHub @the-deniss) and Dmitry Shmoylov via a GitHub Security Advisory on 2025-12-05 during a security assessment of Kaspersky USB Redirector and Kaspersky Thin Client, both of which embed xrdp. The neutrinolabs team acknowledged the report the same day, began investigation on 2025-12-15, started patch work on 2025-12-18, and merged commit 488c8c7d into main on 2026-01-27 alongside the v0.10.5 release. Backport releases v0.9.27 and v0.10.4.1 were published the same day. Debian shipped DLA-4464-1 for bullseye (xrdp 0.9.21.1-1~deb11u3) and DSA-6123-1 for bookworm/trixie shortly after. NVD assigned a primary CVSS v3.1 base score of 9.8 (CIA all High) on 2026-01-27, while the GitHub Security Advisory and vendor scoring is 9.1 (C:N, I:H, A:H). The threat is treated as CRITICAL across both scorings.

The patch (commit 488c8c7d4d189514a366cd8301b6e816c5218ffa) refactors xrdp_wm_parse_domain_information() to take an explicit unsigned int resultSize parameter, replaces the hard-coded g_memset(resultBuffer, 0, 256) with g_memset(resultBuffer, 0, resultSize), introduces an explicit (unsigned int)pos < resultSize bounds check before string operations, and replaces unsafe g_strncpy() calls with strlcpy() with proper size limits. All callers were updated to pass sizeof() of the destination buffer.

No in-the-wild exploitation has been publicly reported as of 2026-05-08, but the public Kaspersky write-up provides detailed technical specifics — including the payload structure, encoding trick, and stack-frame layout — that materially lower the cost of weaponization. The exposed attack surface is significant: xrdp is broadly deployed on internet-facing Linux jump hosts, lab/education systems, and embedded thin-client appliances. Kaspersky USB Redirector and Kaspersky Thin Client embed vulnerable xrdp builds and require their own vendor updates.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1211 Exploitation for Stealth
- T1046 Network Service Discovery
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service

## Sources

- [CVE-2025-68670: discovering an RCE vulnerability in xrdp (Securelist / Kaspersky)](https://securelist.com/cve-2025-68670/119742/)
- [GHSA-rwvg-gp87-gh6f — Improper bounds checking of domain string length leads to Stack-based Buffer Overflow](https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f)
- [xrdp v0.10.5 release notes (security fix for CVE-2025-68670)](https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.5)
- [xrdp commit 488c8c7d — Merge fix for CVE-2025-68670](https://github.com/neutrinolabs/xrdp/commit/488c8c7d4d189514a366cd8301b6e816c5218ffa)
- [NVD entry for CVE-2025-68670 (Primary CVSS 9.8)](https://nvd.nist.gov/vuln/detail/CVE-2025-68670)
- [Debian Security Tracker — CVE-2025-68670](https://security-tracker.debian.org/tracker/CVE-2025-68670)
- [Debian LTS DLA-4464-1 — xrdp security update (bullseye)](https://lists.debian.org/debian-lts-announce/)
- [Debian DSA-6123-1 — xrdp security update (bookworm/trixie)](https://www.debian.org/security/)
- [MITRE CVE Record — CVE-2025-68670](https://www.cve.org/CVERecord?id=CVE-2025-68670)
- [neutrinolabs/xrdp GitHub repository](https://github.com/neutrinolabs/xrdp)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0484