Read the docs
TI-2026-76478 Aliases CVE-2026-112278GHSA-f67q-4w46-jr64

Heap out-of-bounds read in rdesktop client via bitmap cache order

Priority HIGH 70CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

rdesktop through 1.9.0 contains a heap out-of-bounds read (CWE-125) in process_raw_bmpcache() in orders.c. A malicious RDP server can send a raw bitmap cache order declaring large width, height and bpp values with a tiny payload, so memcpy() reads past the receive buffer and crashes the connecting client.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rdesktoprdesktopup to 1.9.0—No fix listedCNA
  • rdesktop Vendorrdesktop Affected up to 1.9.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rdesktop. Red Hat lists Red Hat Enterprise Linux 6 as affected without a fix and plans no fix for it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-112278
  2. 2026-10-19 Alias added: GHSA-f67q-4w46-jr64
  3. 2026-10-20 Affected versions changed · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-21 Priority changed: MEDIUM → LOW
  6. 2026-10-22 CISA SSVC decision points changed
  7. 2026-10-22 Priority changed: LOW → HIGH

References

Patch 1

Advisory 1

Other 1

  • TI-2026-76479 Heap out-of-bounds read in rdesktop lets rogue servers crash clients CVSS 4.0HIGH 7.1
  • TI-2026-76477 Heap out-of-bounds read in rdesktop lets malicious servers crash clients CVSS 4.0HIGH 7.1
  • TI-2008-01728 Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote… CVSS 2.0HIGH 9.3
  • TI-2008-01729 Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows… CVSS 2.0HIGH 9.3
  • TI-2018-14304 rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global… CVSS 3.0CRITICAL 9.8
  • TI-2018-14303 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a… CVSS 3.0CRITICAL 9.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences