CVE-2026-112278 Details
Description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
A heap out-of-bounds read vulnerability has been identified in rdesktop versions through 1.9.0. The issue resides in the process_raw_bmpcache() function within orders.c. This vulnerability allows malicious RDP servers to crash rdesktop clients by sending raw bitmap cache orders that declare large width, height, and bits-per-pixel values, but with a tiny payload. This discrepancy causes the memcpy() function to read beyond the allocated buffer, leading to a crash. The vulnerability is reachable from a malicious or man-in-the-middle RDP server, with no authentication required before the bitmap data is processed.
Users can update to the latest version of rdesktop, which includes a fix for this vulnerability. Instructions for updating can be found in the rdesktop GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rdesktop | <= 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |