CVE-2026-112277: rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_plane
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
rdesktop clients through 1.9.0 are exposed when they connect to a malicious RDP server. The server can send malformed 32 bpp compressed bitmap data during bitmap updates or bitmap cache orders.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the affected client connects to. No client privileges are required, but the user must initiate or accept the RDP connection.
What is the impact of successful exploitation?
A malicious server can cause the rdesktop client to read beyond its receive buffer and crash, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.