Heap Out-of-Bounds Read Vulnerability in rdesktop by rdesktop
CVE-2026-112278

7.1HIGH

Key Information:

Vendor

Rdesktop

Status
Rdesktop
Vendor
CVE Published:
19 October 2026

What is CVE-2026-112278?

The rdesktop software, up to version 1.9.0, has a vulnerability in the process_raw_bmpcache() function that handles raw bitmap cache orders. This vulnerability allows malicious RDP servers to exploit the issue by sending specially crafted requests with oversized width, height, and bits per pixel (bpp) values. Consequently, when memcpy() attempts to process these orders, it reads beyond the designated buffer, leading to a client crash. This precise mechanism of exploiting memory allocation can jeopardize system stability and reliability for users utilizing the rdesktop application.

Affected Version(s)

rdesktop 0 <= 1.9.0

References

https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oo...
third-party-advisory
https://github.com/rdesktop/rdesktop/pull/437
patchissue-tracking
https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.