Description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rdesktop rdesktop
Default version status: unaffected
0 to ≤ 1.9.0affected
pkg:github/rdesktop/rdesktopReferences
- https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read ↗
- https://github.com/rdesktop/rdesktop/pull/437 ↗
- https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c ↗
- https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-raw-bmpcache ↗
- https://hackmd.io/@haindpwn/cve-2026-112277-112278-112279-rdesktop-bitmap-decompress-oob-read ↗