CVE-2026-112277
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in…
- Risk score
- 46/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orde…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
- https://github.com/rdesktop/rdesktop/blob/v1.9.0/bitmap.c
- https://github.com/rdesktop/rdesktop/issues/436
- https://github.com/rdesktop/rdesktop/pull/437
- https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read
- https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-plane
- https://github.com/rdesktop/rdesktop/issues/436
- https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read
Original description
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
Last activity 19 Oct 2026. Patch Forecast updates every hour.