---
id: "CVE-2026-112277"
kind: "vulnerability"
aliases: ["CVE-2026-112277"]
title: "rdesktop: malformed RDP bitmaps let a hostile server crash clients"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rdesktop", "fixed": [], "affected": "<= 1.9.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["client-side", "denial-of-service", "linux", "package", "rdesktop", "rdp-clients"]
not_affected_if: ["not-using-rdesktop", "trusted-servers-only"]
published_at: "2026-10-19T14:17:05+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:40:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112277", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:40:24+00:00"}]
---

# rdesktop: malformed RDP bitmaps let a hostile server crash clients

rdesktop through 1.9.0 has a heap out-of-bounds read in process_plane() (bitmap.c) on 32 bpp compressed bitmaps. A malicious RDP server can crash a connecting client (DoS, CWE-125, not code execution). Affects anyone running the rdesktop client (incl. Debian bookworm/trixie/sid 1.9.0) who connects to a server an attacker controls or can impersonate; servers are unaffected, and teams not using rdesktop or only connecting to trusted hosts can skip it. No fixed release yet; fix PR #437 is open.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:rdesktop affected <= 1.9.0 fixed ?

## How to check

Run 'rdesktop -V' (or check your package: dpkg -l rdesktop / rpm -q rdesktop). Version 1.9.0 or earlier is affected; no patched upstream version exists yet.

## Fix

No fixed release as of 2026-10-25 (latest is 1.9.0, affected). Upstream PR #437 (rdesktop/rdesktop) is open and unmerged. Until then, only connect to RDP servers you trust, or use a different client (FreeRDP).

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112277
- 2026-10-25T03:40:24+00:00 analyst — No fixed rdesktop release exists: 1.9.0 is latest, fix PR #437 still open/unmerged; Debian tracker shows unfixed (unimportant). CVSS 4.0 7.1 / 3.1 6.5 (VulnCheck CNA; NVD not scheduled). Availability only (crash); no exploit known; not exploited. Nothing marked verified (no vendor advisory).

## Documents

- [advisory] VulnCheck: rdesktop through 1.9.0 Heap OOB Read via process_plane https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-plane
- [describes] Issue #436 rdesktop 1.9.0 memory safety findings https://github.com/rdesktop/rdesktop/issues/436
- [fix] PR #437 Harden bitmap and MPPC parsing (open) https://github.com/rdesktop/rdesktop/pull/437
- [mentions] Debian tracker: unfixed https://security-tracker.debian.org/tracker/CVE-2026-112277

## From the sources

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_