CVE-2026-112278 in rdesktop
Summary
by MITRE • 10/19/2026
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in rdesktop versions through 1.9.0 represents a critical heap-based out-of-bounds read flaw located within the process_raw_bmpcache function of the orders.c source file. This component is responsible for handling raw bitmap cache orders, which are essential for rendering graphical elements during remote desktop sessions. The root cause lies in insufficient validation of input parameters before memory operations are executed. Specifically, when a malicious Remote Desktop Protocol server sends an order with artificially inflated width and height values combined with a specific bits-per-pixel setting, the client application allocates a buffer based on these dimensions but fails to verify that the incoming data payload is sufficiently large to fill it or aligns correctly with memory boundaries. Consequently, during the execution of the memcpy operation intended to copy bitmap data into this allocated space, the function attempts to read beyond the limits of the receive buffer. This discrepancy between expected and actual data size triggers a heap out-of-bounds read condition, leading directly to application instability.
From an operational perspective, this vulnerability allows for remote code execution scenarios or denial of service attacks against clients connecting to untrusted or compromised RDP servers. The immediate impact is a crash of the rdesktop client process due to memory access violations. While the primary manifestation described is a crash, heap-based out-of-bounds reads can also lead to information disclosure if the attacker can control what data is read from adjacent memory regions. This could potentially expose sensitive session data or internal application states to an external adversary. The attack vector requires network connectivity to the target client and relies on the victim initiating a connection to a malicious server, placing this vulnerability within the context of active exploitation against remote services rather than passive listening scenarios.
In terms of industry classification standards, this flaw aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. It also relates to CWE-20, improper input validation, as the failure stems from not adequately checking the size and integrity of incoming network packets against allocated memory constraints. Within the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with initial access and execution via remote services, specifically leveraging weaknesses in common protocols like RDP to disrupt service availability or potentially gain footholds if further exploitation vectors are chained with other flaws such as heap corruption leading to code execution.
Mitigation strategies for this vulnerability primarily involve upgrading rdesktop to a version later than 1.9.0 where the issue has been patched by implementing strict bounds checking on bitmap cache parameters before processing. Organizations relying on legacy systems that cannot be immediately upgraded should consider network-level controls such as firewalls or intrusion prevention systems configured to inspect RDP traffic for anomalous packet sizes and malformed order structures. Additionally, restricting access to RDP services from untrusted networks and enforcing mutual authentication can reduce the attack surface by preventing connections from potentially malicious servers. Regular patch management and vulnerability scanning of remote desktop infrastructure are essential practices to maintain security posture against such protocol-level exploits.