TI-2026-76479 Aliases CVE-2026-112279 GHSA-3rm3-gwm3-q9hj

Heap out-of-bounds read in rdesktop lets rogue servers crash clients

MEDIUM 64CWE-125Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

rdesktop through 1.9.0 has a heap out-of-bounds read in process_bmpcache2() (CWE-125). A malicious RDP server sends crafted revision-2 bitmap cache orders that make the client read past its receive buffer and crash. A user who connects to such a server triggers the denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00306 23rd percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rdesktop	rdesktop	up to 1.9.0	—	No fix listed	CNA

rdesktop Vendorrdesktop Affected up to 1.9.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rdesktop. Red Hat lists Red Hat Enterprise Linux 6 as affected with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope

Timeline

2026-10-19 Threatist record created from CVE-2026-112279
2026-10-19 Alias added: GHSA-3rm3-gwm3-q9hj
2026-10-20 CISA SSVC decision points changed
2026-10-20 Affected versions changed · Red Hat
2026-10-20 CVSS score added · Red Hat

References

Patch 1

https://github.com/rdesktop/rdesktop/pull/437

Advisory 1

https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read

Other 2

TI-2026-76478 Heap out-of-bounds read in rdesktop client via bitmap cache order CVSS 4.0HIGH 7.1
TI-2026-76477 Heap out-of-bounds read in rdesktop lets malicious servers crash clients CVSS 4.0HIGH 7.1
TI-2008-01728 Integer underflow in the iso_recv_msg function (iso.c) in rdesktop 1.5.0 allows remote… CVSS 2.0HIGH 9.3
TI-2008-01729 Buffer overflow in the process_redirect_pdu (rdp.c) function in rdesktop 1.5.0 allows… CVSS 2.0HIGH 9.3
TI-2018-14304 rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global… CVSS 3.0CRITICAL 9.8
TI-2018-14303 rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a… CVSS 3.0CRITICAL 9.8

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences