TI-2026-76477 Aliases CVE-2026-112277 GHSA-8gqw-q36r-ch2f

Heap out-of-bounds read in rdesktop lets malicious servers crash clients

MEDIUM 64CWE-125Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

rdesktop through 1.9.0 is affected. A heap out-of-bounds read in process_plane() in bitmap.c (CWE-125) lets a malicious RDP server crash clients. The server sends malformed 32 bpp compressed bitmaps that declare a large geometry with a short body, so the client reads past its receive buffer and suffers a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs or bitmap cache orders, causing unbounded reads past the receive buffer and denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0039 33rd percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rdesktop	rdesktop	up to 1.9.0	—	No fix listed	CNA

rdesktop Vendorrdesktop Affected up to 1.9.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rdesktop. Red Hat lists no fix planned for Red Hat Enterprise Linux 6.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope

Timeline

2026-10-19 Threatist record created from CVE-2026-112277
2026-10-19 Alias added: GHSA-8gqw-q36r-ch2f
2026-10-20 CISA SSVC decision points changed
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat

References

Patch 1

https://github.com/rdesktop/rdesktop/pull/437

Advisory 1

https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read

Other 2

TI-2026-76478 Heap out-of-bounds read in rdesktop client via bitmap cache order CVSS 4.0HIGH 7.1
TI-2026-76479 Heap out-of-bounds read in rdesktop lets rogue servers crash clients CVSS 4.0HIGH 7.1
TI-2008-01728 Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote… CVSS 2.0HIGH 9.3
TI-2008-01729 Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows… CVSS 2.0HIGH 9.3
TI-2018-14304 rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global… CVSS 3.0CRITICAL 9.8
TI-2018-14303 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a… CVSS 3.0CRITICAL 9.8

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences