{"id":"CVE-2026-112277","kind":"vulnerability","aliases":["CVE-2026-112277"],"related":[],"title":"rdesktop: malformed RDP bitmaps let a hostile server crash clients","description":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.","summary":"rdesktop through 1.9.0 has a heap out-of-bounds read in process_plane() (bitmap.c) on 32 bpp compressed bitmaps. A malicious RDP server can crash a connecting client (DoS, CWE-125, not code execution). Affects anyone running the rdesktop client (incl. Debian bookworm/trixie/sid 1.9.0) who connects to a server an attacker controls or can impersonate; servers are unaffected, and teams not using rdesktop or only connecting to trusted hosts can skip it. No fixed release yet; fix PR #437 is open.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rdesktop","fixed":[],"affected":"<= 1.9.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["client-side","denial-of-service","linux","package","rdesktop","rdp-clients"],"not_affected_if":["not-using-rdesktop","trusted-servers-only"],"how_to_check":"Run 'rdesktop -V' (or check your package: dpkg -l rdesktop / rpm -q rdesktop). Version 1.9.0 or earlier is affected; no patched upstream version exists yet.","fix":"No fixed release as of 2026-10-25 (latest is 1.9.0, affected). Upstream PR #437 (rdesktop/rdesktop) is open and unmerged. Until then, only connect to RDP servers you trust, or use a different client (FreeRDP).","status":"open","published_at":"2026-10-19T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:35:02+00:00","updated_at":"2026-10-25T03:40:24+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-25T03:35:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"rdesktop: malformed RDP bitmaps let a hostile server crash clients","impact":"low","summary":"rdesktop through 1.9.0 has a heap out-of-bounds read in process_plane() in bitmap.c when decoding 32 bpp compressed bitmaps. A malicious RDP server can crash connecting clients by declaring a large bitmap geometry with a short compressed body, causing denial of service.","category":"package","nicknames":[],"who_cares":["rdesktop","linux","rdp-clients"],"confidence":0.6,"needs_auth":"no","worst_case":"Client crashes via malicious RDP server bitmap data","analyst_note":"Confirm whether a fixed rdesktop release exists and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112277 for the patched version and CVSS vector.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["trusted-servers-only"],"who_is_affected":"Affects rdesktop clients up to and including 1.9.0 that connect to RDP servers the user does not fully trust. The sources describe a denial of service from a malicious server, not code execution, and do not say which distributions have patched.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000575,"input_tokens":3372,"output_tokens":475,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a fixed rdesktop release exists and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112277 for the patched version and CVSS vector.","search":"'-112277':13A,16A '-125':62B '-2026':12A,15A '1.9.0':33B,75B,115C '32':47B,141C '437':110B 'affect':66B 'allow':131C 'anyon':67B 'attack':82B,145C 'bitmap':4A,50B,144C,150C,158C,162C 'bitmap.c':45B,129C 'bodi':156C 'bookworm/trixie/sid':74B 'bound':40B,122C 'bpp':48B,142C 'buffer':171C 'cach':163C 'caus':165C 'client':10A,19B,30B,59B,71B,137C 'client-sid':18B 'code':64B 'compress':49B,143C,155C 'connect':58B,77B,97B 'contain':116C 'control':83B 'crash':9A,56B,136C 'cve':11A,14A 'cwe':61B 'debian':73B 'declar':147C 'denial':22B,173C 'denial-of-servic':21B 'dos':60B 'execut':65B 'fix':105B,108B 'geometri':151C 'heap':36B,118C 'host':100B 'hostil':7A 'imperson':86B 'incl':72B 'larg':149C 'let':5A 'linux':25B 'malform':2A,140C 'malici':52B,132C 'open':112B 'order':164C 'out-of-bound':37B,119C 'packag':26B 'past':168C 'pdus':160C 'plane':44B,127C 'pr':109B 'process':43B,126C 'rdesktop':1A,17A,27B,31B,70B,94B,113C 'rdp':3A,29B,53B,133C 'rdp-client':28B 'read':41B,123C,167C 'receiv':170C 'releas':106B 'run':68B 'send':139C 'server':8A,54B,80B,87B,134C 'servic':24B,175C 'short':154C 'side':20B 'skip':102B 'team':91B 'trust':99B 'unaffect':89B 'unbound':166C 'updat':159C 'use':93B 'vulner':124C 'yet':107B","nicknames":[],"mitigations":[],"who_affected":"Affects rdesktop clients up to and including 1.9.0 that connect to RDP servers the user does not fully trust. The sources describe a denial of service from a malicious server, not code execution, and do not say which distributions have patched.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112277","severity":null,"published_at":"2026-10-19T14:17:05+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112277:768","url":null,"severity":null,"published_at":"2026-10-25T03:40:24+00:00","modified_at":"2026-10-25T03:40:24+00:00","first_seen_at":"2026-10-25T03:40:24+00:00","fetched_at":"2026-10-25T03:40:24+00:00","note":"No fixed rdesktop release exists: 1.9.0 is latest, fix PR #437 still open/unmerged; Debian tracker shows unfixed (unimportant). CVSS 4.0 7.1 / 3.1 6.5 (VulnCheck CNA; NVD not scheduled). Availability only (crash); no exploit known; not exploited. Nothing marked verified (no vendor advisory)."}],"documents":[{"id":3275,"url":"https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-plane","title":"VulnCheck: rdesktop through 1.9.0 Heap OOB Read via process_plane","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3277,"url":"https://github.com/rdesktop/rdesktop/pull/437","title":"PR #437 Harden bitmap and MPPC parsing (open)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":3278,"url":"https://security-tracker.debian.org/tracker/CVE-2026-112277","title":"Debian tracker: unfixed","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":3279,"url":"https://github.com/rdesktop/rdesktop/issues/436","title":"Issue #436 rdesktop 1.9.0 memory safety findings","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}