{"id":"CVE-2026-112278","kind":"vulnerability","aliases":["CVE-2026-112278"],"related":[],"title":"rdesktop: malicious RDP server crashes client via heap out-of-bounds read","description":"rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.","summary":"rdesktop through 1.9.0 has a heap out-of-bounds read in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with oversized dimensions and a tiny payload, making memcpy() read past the receive buffer and crash the client.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","rdesktop","rdp-clients"],"not_affected_if":["no-rdesktop-installed","trusted-rdp-servers-only"],"how_to_check":"- Check the installed version with `rdesktop -version` (unknown if the binary does not report it)\n- Check whether your package manager lists rdesktop at `1.9.0` or earlier","fix":"- Upgrade to a rdesktop release later than `1.9.0` once one is available (unknown whether a fixed version exists in the sources)\n- Connect only to RDP servers you trust until patched","status":"open","published_at":"2026-10-19T14:17:05+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:34:58+00:00","updated_at":"2026-10-25T03:34:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:34:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to a rdesktop release later than `1.9.0` once one is available (unknown whether a fixed version exists in the sources)\n- Connect only to RDP servers you trust until patched","reach":"network","title":"rdesktop: malicious RDP server crashes client via heap out-of-bounds read","impact":"low","summary":"rdesktop through 1.9.0 has a heap out-of-bounds read in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order with oversized dimensions and a tiny payload, making memcpy() read past the receive buffer and crash the client.","category":"package","nicknames":[],"who_cares":["rdesktop","linux","rdp-clients"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Client crashes when connecting to a malicious RDP server","analyst_note":"","how_to_check":"- Check the installed version with `rdesktop -version` (unknown if the binary does not report it)\n- Check whether your package manager lists rdesktop at `1.9.0` or earlier","needs_analyst":false,"not_affected_if":["no-rdesktop-installed","trusted-rdp-servers-only"],"who_is_affected":"Anyone running the rdesktop client to connect to RDP servers, especially servers they do not control. The flaw sits in how the client parses incoming bitmap cache orders, so the risk comes from the server side of the connection. Teams that only use other RDP clients can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000614,"input_tokens":3353,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112278':16A,19A '-2026':15A,18A '1.9.0':28B,74C 'allow':91C 'attack':98C 'bitmap':51B,103C 'bmpcach':40B,87C 'bound':12A,35B,81C 'bpp':111C 'buffer':67B,124C 'cach':52B,104C 'caus':117C 'client':6A,25B,71B,97C,128C 'contain':75C 'crash':5A,69B,96C,126C 'cve':14A,17A 'declar':106C 'dimens':56B 'heap':8A,31B,77C 'height':109C 'larg':107C 'linux':20B 'make':61B 'malici':2A,44B,92C 'memcpi':62B,118C 'order':53B,105C 'orders.c':42B,89C 'out-of-bound':9A,32B,78C 'overs':55B 'packag':21B 'past':64B,121C 'payload':60B,116C 'process':38B,85C 'raw':39B,50B,86C,102C 'rdesktop':1A,22B,26B,72C 'rdp':3A,24B,45B,93C 'rdp-client':23B 'read':13A,36B,63B,82C,120C 'receiv':66B,123C 'send':48B,100C 'server':4A,46B,94C 'tini':59B,115C 'valu':112C 'via':7A 'vulner':83C 'width':108C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the rdesktop client to connect to RDP servers, especially servers they do not control. The flaw sits in how the client parses incoming bitmap cache orders, so the risk comes from the server side of the connection. Teams that only use other RDP clients can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112278","severity":null,"published_at":"2026-10-19T14:17:05+00:00","modified_at":"2026-10-22T03:16:36+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}