CVE-2026-112277 in rdesktop
Summary
by MITRE • 10/19/2026
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in rdesktop versions through 1.9.0 represents a critical security flaw within the Remote Desktop Protocol client implementation, specifically located in the process_plane function found in the bitmap.c source file. This heap-based out-of-bounds read issue stems from an insufficient validation of input data received from remote servers during the rendering of compressed bitmaps. The core technical failure lies in the application's inability to correctly verify that the length of the compressed bitmap data matches the expected dimensions declared by the server, leading to memory access violations when processing malformed inputs.
From a technical perspective, the flaw is triggered when an attacker-controlled RDP server sends a specially crafted update PDU or bitmap cache order containing a discrepancy between the declared geometry and the actual size of the compressed body. By declaring a large bitmap geometry while providing only a short compressed data payload, the rdesktop client attempts to decompress and render the image without adequate bounds checking. This mismatch causes the application to perform unbounded reads past the allocated receive buffer into adjacent memory regions on the heap. Such behavior is characteristic of CWE-125, which defines out-of-bounds read vulnerabilities where software reads data beyond the intended boundary of a buffer.
The operational impact of this vulnerability is primarily focused on service availability rather than confidentiality or integrity in its initial exploitation phase. A malicious actor acting as an RDP server can exploit this flaw to cause a denial of service condition by crashing the rdesktop client application. The crash occurs due to memory access violations resulting from reading invalid heap addresses, which typically leads to immediate termination of the process. While out-of-bounds reads are sometimes associated with information disclosure if sensitive data is leaked into the read buffer, in this specific context involving compressed bitmap processing and typical error handling mechanisms, the most direct and reliable outcome is application instability and crash.
This vulnerability aligns with MITRE ATT&CK technique T1499, specifically Endpoint Denial of Service via Application or System Exploitation, as it involves leveraging a software flaw to disrupt normal operations. Furthermore, it relates to CWE-20, Improper Input Validation, because the application fails to properly sanitize and validate the structural integrity of incoming network data before processing it for graphical rendering. The lack of rigorous checks on the relationship between declared dimensions and actual payload size allows an external actor to manipulate internal memory states unpredictably.
Mitigation strategies should prioritize immediate patching by upgrading rdesktop to a version later than 1.9.0, where this heap validation logic has been corrected. In environments where updating is not immediately feasible, network-level controls such as firewalls or intrusion prevention systems can be configured to inspect RDP traffic for anomalies in bitmap update PDUs and cache orders that exhibit significant discrepancies between header dimensions and payload sizes. Additionally, deploying application whitelisting solutions may help prevent the execution of compromised binaries if an exploit attempt succeeds before patching is applied. Continuous monitoring of client-side logs for unexpected process terminations can also aid in detecting potential exploitation attempts in real-time.