CVE-2026-32107
xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 17, 2026
- Updated
- Apr 22, 2026
- Reserved
- Mar 10, 2026
Description
xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
Weaknesses
- CWE-273 Improper Check for Dropped Privileges
Affected Products
| Product | Versions |
|---|---|
xrdpneutrinolabs |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.