EUVD-2026-104294
GHSA-3rm3-gwm3-q9hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious/MITM RDP server
-
DeliveryClient connects and negotiates session
-
ExploitSend crafted revision-2 bitmap cache order
-
ExecutionTrigger OOB memcpy read past receive buffer
-
ImpactCrash rdesktop client (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim's rdesktop client (version ≤1.9.0) to establish an RDP session with an attacker-controlled or man-in-the-middled RDP server; the server must then send a crafted revision-2 bitmap cache order handled by process_bmpcache2() in orders.c - specifically an uncompressed order with large width/height values or an underflowing mode nibble paired with a short payload. Limiting factors: this is purely a reverse/client-side attack with no server-side exposure, it needs victim-initiated connection to a hostile server (UI:P), and the outcome is limited to a client crash with no code execution, privilege gain, or confirmed data disclosure. |
| Impact | This is a client-side denial-of-service issue, not a code-execution or data-breach flaw, and the signals are internally consistent on that point. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 7.1 almost entirely because of VA:H (availability high) while VC:N and VI:N confirm no confidentiality or integrity impact - so despite CWE-125 (out-of-bounds read, a classic info-leak primitive), the realized impact here is a crash, matching the description's 'denial of service.' The network attack vector is real but inverted from the usual assumption: a MALICIOUS RDP SERVER attacks a connecting client, so UI:P reflects that the victim must initiate/accept the RDP session. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no explicit POC flag was set either, though a detailed public technical write-up and upstream issue/PR exist. Net: a legitimate bug worth patching, but a mid-tier priority - the headline 7.1 overstates urgency for most environments because the outcome is a client crash requiring the victim to connect to an attacker-controlled or MITM'd server, not server-side RCE. |
| Exploit ScenarioDerived | An attacker stands up a malicious RDP server (or MITMs an existing RDP connection) and lures or redirects an rdesktop user to connect to it. Once the client connects, the server sends a crafted revision-2 bitmap cache order with oversized width/height or an underflowing mode nibble plus a short payload, driving memcpy() to read past the receive buffer and crash the rdesktop process. No public weaponized exploit is identified, though a detailed technical write-up (hackmd) documenting the trigger conditions exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Denial of service in rdesktop through 1.9.0 lets a malicious or man-in-the-middled RDP server crash the client by sending a crafted revision-2 bitmap cache order to process_bmpcache2() in orders.c. The CVSS vector indicates the server-side attacker is unauthenticated, but the victim must initiate an RDP connection (UI:P); the outcome is a heap out-of-bounds read and client crash with no code execution, privilege gain, or confirmed data disclosure. No CISA KEV entry or public exploit code was identified at time of analysis, and an upstream fix is proposed in PR 437.
RemediationAI
Vendor-released patch: none confirmed at time of analysis; upstream fix available (PR/commit) at https://github.com/rdesktop/rdesktop/pull/437, and a released patched version is not independently confirmed. Apply PR 437 or upgrade to a release containing it once published. Until then, connect rdesktop only to trusted RDP servers and avoid untrusted or unauthenticated RDP endpoints; use an RDP gateway with strict server certificate validation or pinning to reduce man-in-the-middle exposure; restrict or monitor rdesktop use on high-value endpoints and treat repeated client crashes as a possible attack signal. These compensating controls reduce exposure but do not remove the underlying out-of-bounds read.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rdesktop is an open-source RDP client that processes bitmap cache orders received from the RDP server during a session. process_bmpcache2() in orders.c handles revision-2 bitmap cache orders and, before the fix, failed to validate order dimensions and payload length before invoking memcpy() and decompression routines. An attacker can send an uncompressed order with large width/height values, or an underflowing mode nibble paired with a short payload, causing memcpy() to read past the received buffer, a CWE-125 heap out-of-bounds read. The proposed patch in PR 437 hardens bitmap.c and mppc.c with end-pointer checks in CVAL/CVAL2, input_error propagation, size and integer-overflow validation (width > INT_MAX / Bpp / height), and bounds checks in process_plane() and mppc_expand(). No CPE data was provided; affected code is in rdesktop through 1.9.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Malicious server reachable over the network (AV:N/AC:L) but victim must connect to it (UI:R); only the client crashes, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service.
Executive ViewAI
rdesktop through 1.9.0 can be crashed when users connect to a malicious or man-in-the-middled RDP server, creating a client-side denial-of-service risk for staff who rely on this tool for remote access. No public exploit identified at time of analysis, and the issue does not appear to enable code execution, privilege gain, or confirmed data disclosure, so leadership should treat this as an operational availability issue affecting a limited user population rather than an enterprise-wide compromise. Affected teams should prioritize restricting rdesktop connections to trusted RDP endpoints while a fix is coordinated.
No vendor-released patch identified at time of analysis; restrict rdesktop through 1.9.0 to trusted RDP servers and approved gateways, replace it with a supported RDP client where feasible, block direct outbound RDP to untrusted destinations, monitor for client crashes, and track upstream PR 437 for a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB