Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

rdesktop versions up to 1.8.3 allow remote hackers to crash or control your system

CVE-2018-8794 · published 7 years ago
Summary

Older versions of rdesktop, a remote desktop client, contain a bug that can be exploited by a hacker to crash or take control of your system. This could lead to unauthorized access to your data or disruption of your business. Update to the latest version of rdesktop to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
rdesktop rdesktop <= 1.8.3
cpe:2.3:a:rdesktop:rdesktop:*:*:*:*:*:*:*:*
debian debian_linux 8.0
9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
opensuse leap 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Original advisory text
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly ev...
rdesktop versions up to and including v1.8.3 contain an Integer Overflow that leads to an Out-Of-Bounds Write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-680Integer Overflow to Buffer Overflow
CWE-190Integer Overflow
CWE-787Out-of-bounds Write
Timeline
Published5 Feb 2019
Updated4 Nov 2026
First seen11 Apr 2026
Sources
CVE-2018-8794 · OSV
CVE-2018-8794 · NVD
Track software like this
Free during beta