CVE-2026-112279 Details
Description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
A heap out-of-bounds read vulnerability has been identified in rdesktop versions through 1.9.0. The issue resides in the 'process_bmpcache2' function within 'orders.c', where the vulnerability allows malicious RDP servers to crash clients by sending crafted revision-2 bitmap cache orders. Exploitation involves sending an uncompressed order with exaggerated width and height or a mode nibble that causes an underflow, paired with a short payload. This manipulation leads to 'memcpy' operations reading beyond the intended buffer, causing a denial-of-service condition by crashing the client.
Users can update to the latest version of rdesktop, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read | CISA-ADP | BundleTechnical Analysis |
| https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c | [email protected] | Source CodeVendor |
| https://github.com/rdesktop/rdesktop/issues/436 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/rdesktop/rdesktop/pull/437 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-bmpcache2 | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rdesktop | <= 1.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |