Live › vulnerability › CVE-2026-112277
Go to dashboardrdesktop through 1.9.0 has a heap out-of-bounds read in process_plane() (bitmap.c) on 32 bpp compressed bitmaps. A malicious RDP server can crash a connecting client (DoS, CWE-125, not code execution). Affects anyone running the rdesktop client (incl. Debian bookworm/trixie/sid 1.9.0) who connects to a server an attacker controls or can impersonate; servers are unaffected, and teams not using rdesktop or only connecting to trusted hosts can skip it. No fixed release yet; fix PR #437 is open.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affects rdesktop clients up to and including 1.9.0 that connect to RDP servers the user does not fully trust. The sources describe a denial of service from a malicious server, not code execution, and do not say which distributions have patched.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| rdesktop | vendor | <= 1.9.0 | – |
rdesktop -V (or check your package: dpkg -l rdesktop / rpm -q rdesktop)1.9.0 or earlier is affected; no patched upstream version exists yet1.9.0, affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-112277")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.