Live › vulnerability › CVE-2026-112278
Go to dashboardrdesktop through 1.9.0 has a heap out-of-bounds read in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with oversized dimensions and a tiny payload, making memcpy() read past the receive buffer and crash the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running the rdesktop client to connect to RDP servers, especially servers they do not control. The flaw sits in how the client parses incoming bitmap cache orders, so the risk comes from the server side of the connection. Teams that only use other RDP clients can skip it.
No product ranges from the sources yet.
rdesktop -version (unknown if the binary does not report it)1.9.0 or earlier1.9.0 once one is available (unknown whether a fixed version exists in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-112278")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.