Release notes for xrdp v0.10.5 (2026/01/27)
Security fixes
- CVE-2025-68670: Improper bounds checking of domain string length leads to Stack-based Buffer Overflow
New features
- It is now possible to start the xrdp daemon entirely unprivileged from the service manager (#3599 #3603). If you do this certain restrictions will apply. See https://github.com/neutrinolabs/xrdp/wiki/Running-the-xrdp-process-as-non-root for details.
- TLS pre-master secrets can now be recorded for packet captures (#3617)
- Add a FuseRootReportMaxFree to work around 'no free space' issues with some file managers (#3639)
- Alternate shell names can now be passed to startwm.sh in an environment variable for more system management control (#3624 #3651)
- Updated Xorg paths in sesman.ini to include more recent distros (#3663)
- Add Slovenian keyboard (#3668 #3670)
- xrdpapi: Add a way to monitor connect/disconnect events (#3693)
Bug fixes
- Allow an empty X11 UTF8_STRING to be pasted to the clipboard (#3580 #3582)
- Fix a regression introduced in v0.10.x, where it became impossible to connect to a VNC server which did not support the ExtendedDesktopSize encoding (#3540 #3584)
- Fix a regression introduced in v0.10.x related to PAM groups handling (#3594)
- Inconsistencies with [MS-RDPBCGR] have been addressed (#3608)
- A reference to uninitialised data within the verify_user_pam_userpass.c module has been fixed (#3638)
- Prevent some possible crashes when the RFX encoder is resized (#3590 #3644)
- Fixes a regression introduced by GFX development which prevented the JPEG encoder from working correctly (#3649)
- Fixes a regression introduced by #2974 which resulted in the xrdp PID file being deleted unexpectedly (#3650)
- Do not overwrite a VNC port set by the user when not using sesman (#3674)
- Fix regression from 0.9.x when freerdp client uses /workarea (#3618 #3676)
- Fixes a crash where a resize is attempted with drdynvc disabled (#3672 #3680)
- getgrouplist() now compiles on MacOS...