CVE-2022-23481: Debian Linux

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out of Bound Read in xrdp_caps_process_confirm_active() function. There are no known workarounds for this issue. Users are advised to upgrade.

Affected products

• Debian Debian Linux: version 11.0 only
• Neutrinolabs Xrdp: before 0.9.21 (fixed in 0.9.21)

Published 2022-12-09. Last modified 2026-06-17.