Description

RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T23:16:19.810Z",
  "pubdate": "2026-08-19T23:16:19.810Z",
  "executiveSummary": "A denial of service vulnerability exists within the Remote Desktop Protocol (RDP) protocol dissector affecting specific software versions. The flaw enables remote attackers to trigger application crashes, resulting in an unavailablity of service for legitimate users. The vulnerability specifically impacts versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The risk implication is centered around service disruption and potential system instability when parsing maliciously crafted RDP traffic. Attacker capabilities include the ability to remotely inject malformed packets without necessarily requiring prior authentication or elevated privileges, depending on network exposure and listening interfaces. Exploitation requirements involve the target system actively processing incoming RDP streams through the vulnerable protocol dissector component.",
  "technicalDetails": "The vulnerability resides in the RDP protocol dissector component, which is responsible for parsing and interpreting Remote Desktop Protocol traffic. The root cause stems from improper input validation and handling of malformed or unexpected protocol structures within the affected code paths. When the dissector encounters a specifically crafted RDP payload, it fails to handle edge cases or boundary conditions safely, leading to memory corruption, null pointer dereferences, or unhandled exceptions that terminate the parsing process.\nThe affected software versions include 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Exploitation occurs over the network by transmitting a malicious RDP payload directly to a listening interface or system configured to parse RDP traffic using the vulnerable dissector. As the protocol analyzer or application ingests the stream, it attempts to decode the malicious packet structure. The failure to correctly parse the input triggers a fatal runtime exception or crash of the host process, halting all further protocol analysis and disrupting dependent services.\nNetwork exposure is a primary vector, as the attack relies on sending network traffic to the vulnerable service. Depending on the architecture, authentication and privilege requirements may be minimal or non-existent if the dissector processes pre-authentication traffic or unverified network streams. The payload behavior is strictly destructive regarding availability, causing an immediate denial of service condition without providing mechanisms for remote code execution based strictly on the provided description. Post-exploitation impact is limited to persistent or repeatable service outages if the attacker continuously transmits the crashing sequence."
}