rdesktop CVE-2026-112277

Requires the rdesktop client (versions through 1.9.0) to establish an RDP session to an attacker-controlled or compromised server; the server must send a bitmap update PDU or bitmap cache order that declares a large 32 bpp compressed bitmap geometry while supplying a truncated compressed body, which drives process_plane() to read past the receive buffer. LIMITING FACTORS: the attacker cannot reach the client unsolicited - the victim must actively connect to the malicious server (UI:P), so this is exploitable only against outbound RDP connections to untrusted endpoints; impact is confined to crashing the client process (availability only), with no code execution, data disclosure, or integrity impact indicated by the CVSS vector.

This is a client-side denial-of-service vulnerability in the rdesktop RDP client. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) shows the only real impact is availability (VA:H) - the client crashes - with no confidentiality or integrity impact (VC:N/VI:N). Exploitation requires the victim to initiate or continue an RDP session to an attacker-controlled or compromised server (UI:P, a passive user action), so this is NOT a server-side, wormable, or self-propagating flaw. There is no CISA KEV listing and no explicit exploit-code flag in the input, so exploitation status is 'no public exploit identified at time of analysis'; however a detailed technical write-up (hackmd) and a vendor patch PR exist, which materially lowers the barrier to weaponization for a DoS. No EPSS score was provided, so probabilistic exploitation likelihood cannot be stated. Note a conflict between the metadata and the official severity data: the input Tags include 'Information Disclosure', but the authoritative CVSS vector sets VC:N (no confidentiality impact) and the description characterizes the outcome strictly as a crash/denial of service - the OOB read's data is not returned to the attacker. Overall this is a moderate, situational risk (malicious/compromised RDP endpoints) rather than a top-tier priority: real for environments where clients connect to untrusted RDP servers, but limited to availability loss on the connecting client.

A victim uses the rdesktop client to connect to a malicious or compromised RDP server. The server sends a bitmap update PDU (or bitmap cache order) declaring a large 32 bpp bitmap geometry but supplying a short compressed body, causing process_plane() in bitmap.c to read past the end of the receive buffer and crash the client. A public technical write-up documents the flaw, but no packaged exploit code is identified in the provided data; exploitation needs no authentication (PR:N) but does require the user to connect to the attacker's server (UI:P).