CVE-2026-112279

Estado: AplazadaAlta (7.1)—

Gravedad7.1Alta · CVSS 4.0

Probabilidad de explotación0.31 %mayor que el 22 % de las CVE

Explotación activaNono figura en el catálogo de CISA

Exploit públicoNo conocidosin código público localizado

rdesktop hasta la versión 1.9.0 contiene una vulnerabilidad de lectura fuera de límites en el heap en la función process_bmpcache2() del archivo orders.c que permite a servidores RDP maliciosos bloquear los clientes mediante órdenes de caché de mapas de bits de revisión 2 manipuladas. Los atacantes pueden enviar una orden sin comprimir con valores grandes de width/height o un nibble de modo con desbordamiento por defecto y una carga útil corta, lo que provoca lecturas mediante memcpy() más allá del búfer de recepción y una denegación de servicio (DoS).

Traducción automática del texto original de NVD (en inglés).

CVSS

Puntuación base: 7.1
Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.31 %
Percentil entre todas las CVEs puntuadas: 22
Fecha de la puntuación: 20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution60 %
Impacto principalT1499 Endpoint Denial of Serviceimpact55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Rdesktop — Rdesktop^AI

CWE

CWE-125

Referencias

Mostrar las 6 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-112279",
  "cveTags": [
    {
      "tags": [
        "unsupported-when-assigned"
      ],
      "sourceIdentifier": "disclosure@vulncheck.com"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-112279",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-19T17:55:41.199632Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "repo": "https://github.com/rdesktop/rdesktop",
          "vendor": "rdesktop",
          "product": "rdesktop",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.9.0"
            }
          ],
          "packageURL": "pkg:github/rdesktop/rdesktop",
          "collectionURL": "https://github.com/rdesktop/rdesktop",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-19T14:17:05.977",
  "references": [
    {
      "url": "https://github.com/rdesktop/rdesktop/blob/v1.9.0/orders.c",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/rdesktop/rdesktop/issues/436",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/rdesktop/rdesktop/pull/437",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/rdesktop-through-1.9.0-heap-out-of-bounds-read-via-process-bmpcache2",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://hackmd.io/@haindpwn/rdesktop-bitmap-decompress-oob-read",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble and short payload, causing memcpy() reads past the receive buffer and denial of service."
    }
  ],
  "lastModified": "2026-10-19T21:14:14.150",
  "sourceIdentifier": "disclosure@vulncheck.com"
}