This vulnerability is a heap out-of-bounds read in the process_plane() function of bitmap.c. A malicious RDP server can send 32‑bpp compressed bitmap data that declares a large bitmap geometry while providing a short compressed body. When the client parses the packet, it reads beyond the allocated buffer, leading to a crash. This results in a denial of service for the affected client.

The affected product is the rdesktop Remote Desktop client. All releases up to and including version 1.9.0 are susceptible to the out-of-bounds read. The issue was tracked in the rdesktop repository (see issue #436 and pull request #437) and applies to any installation of rdesktop that has not been updated beyond the patched release.

The CVSS score of 7.1 indicates a high severity impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by establishing an RDP session with a malicious server that transmits malformed bitmap updates or bitmap cache orders. When the client processes the 32‑bpp compressed data, it performs unbounded reads past the receive buffer, causing a crash and denying the service. The vector is inbound from the RDP server, requiring an active RDP connection to be present.