PatchTheCVECVE-2018-20179: rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Ov
CVE-2018-20179 is a critical-severity flaw (CVSS 9.8) affecting rdesktop. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.
Why this priority
- Critical severity
- EPSS top 6%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 6.8% (top 6%) |
| CISA exploited list | No |
| Weakness | CWE-191 |
| Published | 2019-03-15 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-20179?
rdesktop: upgrade to newer than 1.8.3. Exact commands for each OS are on this page.
Is CVE-2018-20179 being exploited?
CVE-2018-20179 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-20179 affect?
CVE-2018-20179 affects rdesktop. Severity is critical (CVSS 9.8). rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.
How urgent is CVE-2018-20179?
Priority 68/100. Critical severity; EPSS top 6%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2019-15682 HIGH 7.5 DOWNGRADE RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results i
- CVE-2018-8800 CRITICAL 9.8 UPGRADE MITIGATE rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_d
- CVE-2018-8799 HIGH 7.5 UPGRADE MITIGATE rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function process_secondary_order
- CVE-2018-8798 HIGH 7.5 UPGRADE MITIGATE rdesktop versions up to and including v1.8.3 contain an Out-Of-Bounds Read in function rdpsnd_process_ping() t
- CVE-2018-8797 CRITICAL 9.8 UPGRADE MITIGATE rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane()