The vulnerability is a heap out‑of‑bounds read in the process_raw_bmpcache() function within orders.c of rdesktop. A malicious RDP server can send a raw bitmap cache order that declares excessive width, height, and bits‑per‑pixel values but supplies only a small payload, causing memcpy() to read beyond the received buffer. This overflow can crash the rdesktop client, which results in a denial‑of‑service condition for the user.

All versions of the rdesktop client up to and including 1.9.0 are affected. The vendors identified are rdesktop. The impact applies to any system running those client versions without the fix.

The CVSS score of 7.1 indicates a moderate severity vulnerability, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploitation in the wild. The likely attack vector is remote, originating from an RDP server that the client connects to. Because the flaw triggers when the client parses a specially crafted bitmap cache order, an attacker only needs the ability to initiate an RDP session with the vulnerable client.