Critical Heap-Based Buffer Overflow in rdesktop Package

rdesktop Updated 02 Oct 2025

Summary

05/02/2019

Disclosed on

N/A

Severity

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

ALPINE-CVE-2018-8797: rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution. Affects rdesktop versions < 1.8.6-r0. Fixed in 1.8.6-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

rdesktop is an open-source client for the Remote Desktop Protocol (RDP), allowing users to connect to Windows desktops and servers. It is widely used for remote access to Windows environments from Unix-like systems. The package provides essential features for remote desktop connectivity, but it has been found vulnerable to a critical security flaw that can lead to severe consequences if exploited.

Vulnerability Detail

The vulnerability identified as ALPINE-CVE-2018-8797 is a Heap-Based Buffer Overflow present in rdesktop versions up to and including v1.8.3. This flaw exists in the function process_plane(), which can lead to memory corruption and potentially allow an attacker to execute arbitrary code remotely. The severity of this vulnerability is underscored by its CVSS score of 9.8, indicating a critical risk to systems utilizing affected versions of the package.

How To Fix

Minimum fixed version

1.8.6-r0

This is the first release that contains the fix.

sudo apk add --upgrade rdesktop

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, users may consider disabling the use of rdesktop until the package is updated to a secure version. This can help mitigate the risk of exploitation while waiting for a proper fix.

Conclusion

The rdesktop package has a critical vulnerability that poses significant risks to users. It is crucial to update to the patched version to mitigate potential threats. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.

See every vulnerability recorded for rdesktop →