Kaspersky researchers Denis Skvortsov and Dmitry Shmoylov have disclosed CVE-2025-68670, a pre-authentication stack buffer overflow in the open-source xrdp remote desktop server for Linux. The flaw was found during an internal security assessment of Kaspersky USB Redirector, a module that extends xrdp for Kaspersky Thin Client deployments, and the upstream neutrinolabs maintainers have already shipped fixes in xrdp 0.10.5 with backports to 0.9.27 and 0.10.4.1.
How the bug works
The vulnerability lives in the xrdp_wm_parse_domain_information function, which handles the domain field of the RDP Client Info PDU before authentication. The RDP protocol allows the username, password, domain, program, and directory strings to each reach 512 bytes after UTF-16 to UTF-8 conversion. When the first character of the supplied domain is an underscore, xrdp interprets the remainder as a combobox index plus an IP, and copies the substring up to the next double underscore into a 256-byte stack buffer named resultIP using g_strncpy. Because the source can be up to 511 bytes long while the destination is only 256 bytes, an attacker can overflow the stack and overwrite the saved return address.
Exploitation requirements
Per Kaspersky's writeup, the bug is reached pre-authentication, meaning no valid credentials are required, and exploitation only needs a crafted RDP file (or equivalent network traffic) containing a domain like _veryveryverK...K__0, where the K characters expand under UTF-16 to UTF-8 conversion to overflow the 256-byte buffer. The supplied proof of concept demonstrates a clean overwrite of the saved return address with controlled bytes (the researchers used 0x4141414141414141 as a marker), with the process subsequently aborting on the stack canary check on hardened builds.
Mitigations and stack canaries
The Kaspersky team and the neutrinolabs maintainers both caution that compiler-emitted stack canaries are not a complete defense. The xrdp security bulletin explicitly advises against relying solely on stack canaries when running the project, since an attacker able to leak the canary value through another bug could still pivot the overflow into reliable code execution as the xrdp service user. We assess with high confidence that any internet-exposed xrdp instance below 0.9.27, 0.10.4.1, or 0.10.5 should be treated as remotely exploitable today, and operators should patch immediately and restrict xrdp listeners to trusted networks behind a VPN or jump host.
Disclosure timeline
- December 5, 2025: Kaspersky reported the issue via GitHub security advisories.
- December 18, 2025: neutrinolabs confirmed and began patching.
- December 24, 2025: CVE-2025-68670 assigned.
- January 27, 2026: Patch merged.
- May 8, 2026: Kaspersky published the technical writeup.
No exploitation in the wild has been publicly attributed so far, but with the technical details and a working proof-of-concept concept now public, opportunistic scanning of port 3389 for xrdp banners is the expected near-term trajectory.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.