Critical Remote Code Execution Flaw in xrdp Threatens Remote Desktop Security
Kaspersky security researchers have uncovered a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-68670, in the xrdp remote desktop server for Linux. The flaw could allow an attacker to execute arbitrary code on vulnerable systems, compromising remote desktop sessions.
Background
xrdp is an open-source implementation of the Remote Desktop Protocol (RDP) commonly used in thin client environments. Kaspersky integrates xrdp into its Kaspersky Thin Client operating system and offers the Kaspersky USB Redirector module to extend USB device access over remote sessions.
Vulnerability Details
The vulnerability resides in the Secure Settings Exchange phase, which occurs before client authentication. During this phase, the client sends protected credentials—including usernames, passwords, and domain names—inside a Client Info PDU (protocol data unit) as TS_INFO_PACKET structures.
These fields are limited to 512 bytes each and use UTF-16 encoding. However, the xrdp server converts them to UTF-8 using the ts_info_utf16_in function. Researchers found that improper buffer size validation in this conversion process can lead to a stack-based buffer overflow, enabling remote code execution.
Disclosure and Fix
Kaspersky reported the issue to the xrdp project maintainers, who responded swiftly. The vulnerability is patched in xrdp version 0.10.5, with backports to versions 0.9.27 and 0.10.4.1. A security bulletin has been issued.
“We take security seriously and grateful to the xrdp team for their fast response,” said a Kaspersky security researcher. “Users should update immediately to block potential exploits.”
What This Means
This vulnerability poses a serious risk to organizations relying on thin clients and remote desktop infrastructure. An attacker with network access could exploit CVE-2025-68670 to take control of an xrdp server without authentication. The flaw has a high severity rating and is likely to attract exploit development.
Users of Kaspersky Thin Client and USB Redirector are urged to apply the latest xrdp patches. The xrdp community recommends upgrading to version 0.10.5 or later, or applying backported patches for older releases. Administrators should review their remote desktop configurations and ensure firewall rules restrict access to trusted networks.
Timeline
- Flaw discovered during Kaspersky’s security audit of USB Redirector
- Reported to xrdp maintainers in [Month Year]
- Fix released in xrdp 0.10.5, backported to 0.9.27 and 0.10.4.1
- CVE-2025-68670 assigned
Related Articles
- How a Trusted CPU-Z Download Became a Silent Malware Attack: A Case Study in Supply Chain Security
- Securing Windows Access: How Boundary and Vault Eliminate Static Credentials and Overly Broad Network Permissions
- Massive Data Breach at UK Biobank Exposes 500,000 Volunteer Records; Multiple Cyber Incidents Rock Industry
- Defeating Multi-Stage Cyber Attacks: A Step-by-Step Defense Strategy
- Canvas Outage During Finals: Cyberattack Disrupts Thousands of Schools
- Canvas Cyberattack Disrupts Education: What Schools Need to Know
- OpenAI Debuts GPT-5.5-Cyber: A Specialized AI Model for Cybersecurity Breakthroughs
- Understanding and Mitigating the 'Copy Fail' Linux Privilege Escalation Vulnerability: A Comprehensive Guide