CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

xrdp pre-authentication stack buffer overflow → RCE

cve · CVE-2025-68670

Coverage
1
first 2026-05-09 → last 2026-10-11
Latest activity
2026-05-09
Kaspersky details an xrdp pre-auth stack overflow fixed since January; exploitation of canary-protected…
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Defender insights

What each entry about CVE-2025-68670 tells a defender to do, newest first.

2026-05-09ROUTINEKaspersky details an xrdp pre-auth stack overflow fixed since January; exploitation of canary-protected builds needs a separate leak

Exposure

Story timeline

  1. 2026-05-09CVE-2025-68670: xrdp pre-authentication stack overflow (CVSS 9.1), fixed in 0.10.5 in January; canary-protected builds need a second flaw to exploit
    trending-vulnerabilitiesKaspersky details an xrdp pre-auth stack overflow fixed since January; exploitation of canary-protected builds needs a separate leak

Hunting pivots

Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Lateral MovementExploitation of Remote Services

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-09/cve-2025-68670-xrdp-pre-authentication-stack-overflow-arbitr · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-05-09/cve-2025-68670-xrdp-pre-authentication-stack-overflow-arbitr · ATT&CK page ↗

Entries about xrdp pre-authentication stack buffer overflow → RCE (1)

2026-05-09 · view entry permalink →

ROUTINECVE-2025-68670updatedNATOA2

CVE-2025-68670: xrdp pre-authentication stack overflow (CVSS 9.1), fixed in 0.10.5 in January; canary-protected builds need a second flaw to exploit

The xrdp project published advisory GHSA-rwvg-gp87-gh6f on 2026-01-27: xrdp before 0.10.5 contains an unauthenticated stack-based buffer overflow in the processing of user domain information during the connection sequence, rated critical with CVSS 3.1 9.1, which could let a remote attacker execute arbitrary code (xrdp, 2026-01-27). The impact is lessened where xrdp was built with stack canary protection, because a second vulnerability would then be needed to leak the canary value (xrdp, 2026-01-27). Kaspersky researchers, who reported the flaw on 2025-12-05, published their technical analysis on 2026-05-08: the vulnerable function copies a domain name of up to 512 bytes into a 256-byte stack buffer, the maintainers fixed it in 0.10.5 and backported the patch to 0.9.27 and 0.10.4.1, and Kaspersky's proof of concept stops at the canary check (Kaspersky Securelist, 2026-05-08). No source reports exploitation.

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_dateprioritycvestechniquessourcesclassificationactionsbodyverification

The xrdp project disclosed and fixed this flaw on 2026-01-27 and scores it CVSS 9.1; builds with stack canary protection need a second vulnerability to leak the canary before the overflow can be exploited (xrdp, 2026-01-27). Kaspersky's article of 2026-05-08 is the reporting researchers' technical analysis, not the first disclosure (Kaspersky Securelist, 2026-05-08). The table of other CVEs that closed the earlier text belonged to unrelated findings and carried values their own sources contradict.

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: xrdp project · Kaspersky Securelist

explore in graph

Where this entity is cited

  • Vulns1

Source distribution

  • github.com1 (50%)
  • securelist.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)