CVE-2026-112278

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112278", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-19T13:25:29.896Z", "datePublished": "2026-10-19T13:55:24.239Z", "dateUpdated": "2026-10-22T02:52:31.934Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:24.239Z"}, "datePublic": "2026-09-25T10:57:05.000Z", "title": "rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache", "descriptions": [{"lang": "en", "value": "rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client."}], "tags": ["unsupported-when-assigned"], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "rdesktop", "product": "rdesktop", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "1.9.0", "status": "affected", "versionType": "custom"}], "collectionURL": "https://github.com/rdesktop/rdesktop", "packageURL": "pkg:github/rdesktop/rdesktop", "repo": "https://github.com/rdesktop/rdesktop"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rdesktop:rdesktop:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.9.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rdesktop/rdesktop/pull/437", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-raw-bmpcache"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112277-112278-112279-rdesktop-bitmap-decompress-oob-read", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T02:52:03.481171Z", "id": "CVE-2026-112278", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T02:52:31.934Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112278", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-22T02:52:03.481171Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/cve-2026-112277-112278-112279-rdesktop-bitmap-decompress-oob-read", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T02:52:25.447Z"}}], "cna": {"tags": ["unsupported-when-assigned"], "title": "rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/rdesktop/rdesktop", "vendor": "rdesktop", "product": "rdesktop", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.9.0"}], "packageURL": "pkg:github/rdesktop/rdesktop", "collectionURL": "https://github.com/rdesktop/rdesktop", "defaultStatus": "unaffected"}], "datePublic": "2026-09-25T10:57:05.000Z", "references": [{"url": "https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/rdesktop/rdesktop/pull/437", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-raw-bmpcache", "name": "VulnCheck Advisory: rdesktop through 1.9.0 Heap Out-of-Bounds Read via process_raw_bmpcache", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rdesktop:rdesktop:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.9.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-19T13:55:24.239Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112278", "state": "PUBLISHED", "dateUpdated": "2026-10-22T02:52:31.934Z", "dateReserved": "2026-10-19T13:25:29.896Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-19T13:55:24.239Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/rdesktop/rdesktop", "defaultStatus": "unaffected", "packageURL": "pkg:github/rdesktop/rdesktop", "product": "rdesktop", "repo": "https://github.com/rdesktop/rdesktop", "vendor": "rdesktop", "versions": [{"lessThanOrEqual": "1.9.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [{"sourceIdentifier": "disclosure@vulncheck.com", "tags": ["unsupported-when-assigned"]}], "descriptions": [{"lang": "en", "value": "rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy() to read past the receive buffer and crash the client."}], "id": "CVE-2026-112278", "lastModified": "2026-10-22T03:16:36.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112278", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-22T02:52:03.481171Z", "version": "2.0.3"}}]}, "published": "2026-10-19T14:17:05.830", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/rdesktop/rdesktop/pull/437"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-raw-bmpcache"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/cve-2026-112277-112278-112279-rdesktop-bitmap-decompress-oob-read"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rdesktop: rdesktop: Denial of Service via heap out-of-bounds read in process_raw_bmpcache", "id": "2555620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555620"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in rdesktop. A malicious Remote Desktop Protocol (RDP) server can exploit an out-of-bounds read vulnerability by sending specially crafted bitmap cache orders specifying large image dimensions alongside an undersized data payload. This causes the client application to read beyond its allocated memory buffer, leading to an immediate crash and a Denial of Service (DoS)."], "name": "CVE-2026-112278", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "rdesktop", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2026-10-19T13:55:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112278\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112278\nhttps://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c\nhttps://github.com/rdesktop/rdesktop/pull/437\nhttps://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read\nhttps://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-raw-bmpcache"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.9.0]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "rdesktop", "source": "cna", "vendor": "rdesktop"}, "product": "rdesktop", "vendor": "rdesktop"}], "created": "2026-10-19T15:45:17.012701+00:00", "updated": "2026-10-19T19:00:04.673500+00:00", "vendors": ["rdesktop", "rdesktop$PRODUCT$rdesktop"]}