CVE-2026-112277 Details
Description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
A heap out-of-bounds read vulnerability has been identified in rdesktop versions through 1.9.0. The issue resides in the 'process_plane' function within 'bitmap.c', where the decoder for 32 bits-per-pixel compressed bitmaps fails to properly validate the input length. This flaw allows malicious RDP servers to send crafted bitmap updates that cause unbounded reads, leading to memory corruption and crashes on the client side. The vulnerability can be exploited by declaring a large bitmap size while sending a short compressed body, causing the decoder to read past the intended buffer and into adjacent memory.
Users can update to rdesktop version 1.9.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rdesktop/rdesktop/issues/436 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read | CISA-ADP | BundleTechnical Analysis |
| https://github.com/rdesktop/rdesktop/blob/v1.9.0/bitmap.c | [email protected] | Source CodeVendor |
| https://github.com/rdesktop/rdesktop/issues/436 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/rdesktop/rdesktop/pull/437 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-plane | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rdesktop | <= 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |