Hello,

I looked at this package just last week. The issue is that xrdp in Debian unstable (version 0.10.1-4.1) is affected by the issues mentioned in https://bugs.kali.org/view.php?id=8958, to the best of my knowledge.

I tested the pair of packages xrdb and xorgxrdp that are currently in Debian experimental, however these packages are also broken, I pinged the Maintainer about it: https://bugs.debian.org/1127009

I noticed that the CVE was fixed in bookworm, I'll check to see if the patches apply neatly to 0.9.24 as well.

Thank you Arnaud, I know this is a little tricky to fix this issue...

I have uploaded xrdp 0.9.27-0kali1 which should hit Kali rolling in a few hours. It's the latest point release from the upstream branch 0.9, it contains the patches for CVE-2025-68670.

Thanks for reporting this issue!