Description: CVE-2026-33516
Author: Abhijith PA <abhijith@debian.org>
Bug-Debian: https://bugs.debian.org/1134339
Origin: https://github.com/neutrinolabs/xrdp/commit/d2a8802c3124c103cd0c40aba661602420d01a73
Forwarded: not-needed
Last-Update: 2026-06-01

--- a/libxrdp/xrdp_caps.c
+++ b/libxrdp/xrdp_caps.c
@@ -24,6 +24,7 @@
 #endif
 
 #include <limits.h>
+#include "guid.h"
 
 #include "libxrdp.h"
 #include "ms-rdpbcgr.h"
@@ -518,6 +519,8 @@ xrdp_caps_process_codecs(struct xrdp_rdp
     int i1;
     char *codec_guid;
     char *next_guid;
+    struct guid guid;
+    char codec_guid_str[GUID_STR_SIZE];
 
     if (len < 1)
     {
@@ -530,22 +533,23 @@ xrdp_caps_process_codecs(struct xrdp_rdp
     for (index = 0; index < codec_count; index++)
     {
         codec_guid = s->p;
-        if (len < 16 + 1 + 2)
+        if (len < GUID_SIZE + 1 + 2)
         {
-            LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_codecs: error");
+            LOG(LOG_LEVEL_ERROR, "Short codec data received");
             return 1;
         }
-        in_uint8s(s, 16);
+        in_uint8a(s, guid.g, GUID_SIZE);
         in_uint8(s, codec_id);
         in_uint16_le(s, codec_properties_length);
-        len -= 16 + 1 + 2;
+        len -= GUID_SIZE + 1 + 2;
         if (len < codec_properties_length)
         {
-            LOG(LOG_LEVEL_ERROR, "xrdp_caps_process_codecs: error");
+            LOG(LOG_LEVEL_ERROR, "Short codec properties");
             return 1;
         }
         len -= codec_properties_length;
         next_guid = s->p + codec_properties_length;
+        guid_to_str(&guid, codec_guid_str);
 
         if (g_memcmp(codec_guid, XR_CODEC_GUID_NSCODEC, 16) == 0)
         {