CVE-2026-112279 in rdesktop
Summary
by MITRE • 10/19/2026
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in rdesktop versions through 1.9.0 represents a critical heap-based out-of-bounds read flaw located within the process_bmpcache2 function found in orders.c. This component is responsible for handling bitmap cache operations, which are essential for rendering graphical elements during remote desktop sessions. The root cause of this vulnerability lies in insufficient validation of input parameters associated with revision-2 bitmap cache orders sent by the remote server. Specifically, when an attacker controls the RDP server side, they can craft malicious packets that exploit weaknesses in how rdesktop processes these specific order types. The flaw allows for memory access beyond the boundaries of allocated buffers, leading to potential information disclosure or service disruption depending on the exact execution context and data read from adjacent memory regions.
The operational impact of this vulnerability is primarily characterized by a denial of service condition affecting client systems attempting to connect to malicious RDP servers. Attackers can trigger this flaw by sending an uncompressed order that contains either excessively large width and height dimensions or utilizes an underflowing mode nibble combined with a short payload. These crafted inputs cause the memcpy function, which is used to copy data into local buffers during processing, to read past the end of the receive buffer. This out-of-bounds access can corrupt memory state or trigger segmentation faults within the client application, resulting in the immediate crash of the rdesktop process. While the primary observed effect is a denial of service due to application termination, heap-based vulnerabilities often carry additional risks such as information leakage if the read data includes sensitive context from adjacent memory allocations.
From a classification perspective, this vulnerability aligns with CWE-125, which defines out-of-bounds read errors where software reads past the end of an allocated buffer. This type of error is particularly dangerous because it can lead to unpredictable behavior and potential exploitation for code execution if combined with other vulnerabilities or specific memory layouts. In terms of attack vectors, this flaw falls under MITRE ATT&CK technique T1059, specifically related to command and script interpreter interactions where the attacker leverages protocol-specific commands to disrupt service integrity. The vulnerability highlights the risks associated with parsing complex binary protocols like RDP without rigorous bounds checking on all input fields derived from network traffic.
Mitigation strategies for this issue involve upgrading rdesktop to a version later than 1.9.0, where developers have implemented proper validation checks within the process_bmpcache2 function to ensure that bitmap dimensions and payload lengths are consistent with allocated buffer sizes before performing memory copy operations. Organizations relying on legacy versions of rdesktop should consider implementing network-level access controls to restrict connections from untrusted or potentially malicious RDP servers until an upgrade can be performed. Additionally, deploying intrusion detection systems capable of identifying anomalous RDP traffic patterns involving unusually large bitmap orders or malformed protocol structures may provide a layer of defense against exploitation attempts targeting this specific vulnerability in environments where immediate patching is not feasible.