CVE-2026-112278
MediumCVSS 6.5Summary
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with large dimensions and a tiny payload, causing reads past the receive buffer and crashing the client.
Risk Assessment
This can lead to denial of service (DoS) by crashing or hanging the rdesktop client when connecting to a malicious RDP server.
Recommendation
Update rdesktop to a version later than 1.9.0 or apply the vendor patch. Connect only to trusted RDP servers.
Other vulnerabilities in rdesktop
See all- CVE-2026-112279Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c. A malicious RDP server can send crafted revision-2 bitmap cache orders, causing reads past the receive buffer and crashing the client.
- CVE-2026-112277Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c. A malicious RDP server can send malformed 32 bpp compressed bitmaps, causing unbounded reads past the receive buffer and denial of service.
Original NVD description (English source)
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS