The flaw is a heap out‑of‑bounds read in the process_bmpcache2 function of rdesktop's orders.c module. It is triggered by a crafted Revision‑2 bitmap cache order sent by an RDP server; for example, an uncompressed order with a very large width or height, or an order with an underflowing mode nibble and an unusually short payload. The memcpy() call then reads past the allocated buffer, causing the client to crash. This results in a denial‑of‑service condition and is classified as CWE‑125.

All rdesktop clients that are 1.9.0 or earlier are affected. No other vendors or product versions were identified as vulnerable.

The vulnerability carries a CVSS score of 7.1, indicating high severity. EPSS information is not available, so the exact exploit probability is unknown. It is also not listed in the CISA KEV catalog. The likely attack vector is a malicious RDP server that can send the vulnerable bitmap cache order to any client that connects. The impact is limited to service interruption of the client; no remote code execution or data disclosure is possible through this vector.