rdesktop EUVD-2026-104295

Exploitation requires the rdesktop client (version ≤1.9.0) to establish an RDP session to an attacker-controlled or compromised server; the malicious server then sends a raw bitmap cache order with large width, height, and bpp fields but an undersized payload. The key limiting factors are: (1) the victim must initiate or accept a connection to the hostile server (UI:P - this is a server-to-client attack, not exploitable against a listening service); (2) impact is limited to crashing the client process with no code execution or data theft; and (3) only rdesktop is affected, not other RDP clients such as FreeRDP or mstsc.

This is a client-side denial-of-service vulnerability whose real-world priority is moderate-to-low despite the 7.1 CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly scopes the impact to availability only - VC:N and VI:N confirm there is no confidentiality or integrity consequence, so this is a crash, not a data-leak or code-execution bug, even though a 'Information Disclosure' tag is attached (see confidence_notes). The attack is network-borne and low-complexity but inverted from the usual model: it requires the victim's rdesktop client to connect to an attacker-controlled or compromised RDP server (UI:P), not an attacker reaching a server, which materially limits mass exploitation. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, and no public exploit was identified - a technical write-up (hackmd) and an upstream fix PR exist but neither constitutes weaponized exploit code. Net: a legitimate bug worth patching for organizations running rdesktop, but it is a targeted client-crash issue rather than a widespread, automatable, high-impact threat; absence of KEV/EPSS signals means exploitation likelihood cannot be quantified from the data given.

An attacker stands up or compromises an RDP server and lures a victim into connecting with rdesktop (e.g., a malicious .rdp link or a trojanized jump host). Once the client connects, the server sends a raw bitmap cache order declaring oversized width/height/bpp with a tiny payload, causing memcpy() in process_raw_bmpcache() to read past the receive buffer and crash the client. No public exploit code was identified, though a technical analysis write-up exists.