CVE-2026-112277
MediumCVSS 6.5Summary
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c. A malicious RDP server can send malformed 32 bpp compressed bitmaps, causing unbounded reads past the receive buffer and denial of service.
Risk Assessment
This can lead to denial of service (DoS) by crashing or hanging the rdesktop client when connecting to a malicious RDP server.
Recommendation
Update rdesktop to a version later than 1.9.0 or apply the vendor patch. Connect only to trusted RDP servers.
Other vulnerabilities in rdesktop
See all- CVE-2026-112279Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c. A malicious RDP server can send crafted revision-2 bitmap cache orders, causing reads past the receive buffer and crashing the client.
- CVE-2026-112278Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with large dimensions and a tiny payload, causing reads past the receive buffer and crashing the client.
Original NVD description (English source)
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS