CVE-2026-112279
MediumCVSS 6.5Summary
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c. A malicious RDP server can send crafted revision-2 bitmap cache orders, causing reads past the receive buffer and crashing the client.
Risk Assessment
This can lead to denial of service (DoS) by crashing or hanging the rdesktop client when connecting to a malicious RDP server.
Recommendation
Update rdesktop to a version later than 1.9.0 or apply the vendor patch. Connect only to trusted RDP servers.
Other vulnerabilities in rdesktop
See all- CVE-2026-112278Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with large dimensions and a tiny payload, causing reads past the receive buffer and crashing the client.
- CVE-2026-112277Medium
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c. A malicious RDP server can send malformed 32 bpp compressed bitmaps, causing unbounded reads past the receive buffer and denial of service.
Original NVD description (English source)
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS