# DejaBlue CVE-2019-1181 – RDP RCE on Modern Windows

> Exploits CVE-2019-1181 pre-auth RDP RCE via heap overflow in MS-RDPBCGR on Windows 8.1/10/Server 2012-2019 without requiring credentials.

- **URL:** https://hackindex.io/services/rdp/exploitation/vulnerabilities/dejablue-cve-2019-1181
- **Path:** RDP > Exploitation > Vulnerabilities
- **Up:** [Vulnerabilities](https://hackindex.io/services/rdp/exploitation/vulnerabilities.md)
- **Published:** 2026-03-11
- **Updated:** 2026-05-15

DejaBlue is a family of heap overflow vulnerabilities in the Windows Remote Desktop Services client: specifically in the `rdpcore.dll` decompression handling. Like BlueKeep, they are pre-authentication and require no user interaction. Unlike BlueKeep, they affect modern Windows versions: Windows 8, 8.1, 10, and Server 2012 through 2019.

Two CVEs cover the family: CVE-2019-1181 (Windows 8 through Server 2019) and CVE-2019-1182 (same scope, slightly different decompression path). Both were patched in August 2019 (Patch Tuesday, KB4512508 and related KBs).

**Honest caveat:** Public weaponised RCE exploits for DejaBlue are significantly less reliable than BlueKeep. Microsoft did not release technical details at disclosure time, and the available public PoCs have stability issues. The Metasploit module does not exist as of writing. For OSCP labs you are more likely to encounter BlueKeep than DejaBlue. This page covers what is available and what to expect.

> [!WARNING]
> This may be restricted in exams such as OSCP. Verify exam rules before use.

## Confirming Vulnerability

Safe detection methodology including rdpscan and Metasploit auxiliary scanner is covered in [RDP Known Vulnerability Detection](https://hackindex.io/services/rdp/vulnerability-discovery/rdp-known-vulnerabilities-detection). For version-based patch level matching, Nmap version detection provides OS build identification:

```bash
nmap -p 3389 -sV --script rdp-enum-encryption $TARGET_IP
```

A more targeted check using the rdpscan tool:

```bash
rdpscan $TARGET_IP
# 10.10.10.10 - VULNERABLE -- got appid
#
```

rdpscan detects BlueKeep and some DejaBlue variants. If the host is running Windows 8 or later and rdpscan flags it, proceed.

Check the patch level via SMB if you have credentials:

```bash
nxc smb $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN
```

Look for `Build` in the output and match against patched builds. August 2019 patches set the build to 17763.678 (Windows 10 1809) or 14393.3143 (Windows Server 2016). Builds below these thresholds on those versions are unpatched.

## DejaBlue CVE-2019-1181 exploit PoC code

The most maintained public PoC is the Rrivera1849 repository, which implements a basic crash/PoC for CVE-2019-1181. It confirms vulnerability but does not deliver a stable shell:

```bash
git clone https://github.com/Rrivera1849/CVE-2019-1181-1182
cd CVE-2019-1181-1182
python3 -m venv .venv && source .venv/bin/activate
pip install impacket
python3 cve_2019_1181.py $TARGET_IP
```

A crash (BSOD on the target) confirms the vulnerability. This is not RCE: it confirms exploitability for reporting purposes.

## Weaponised Exploitation

No stable public RCE exploit equivalent to BlueKeep's Metasploit module exists for DejaBlue as of writing. Commercial tools (Core Impact, Canvas) have reported working modules but these are not publicly available.

If you encounter a DejaBlue-vulnerable target in a lab, the practical path is to fall back to credential-based access:

- Check for default or weak credentials (see [https://hackindex.io/services/rdp/exploitation/brute-force-password-spray](https://hackindex.io/services/rdp/exploitation/brute-force-password-spray))
- If you have network access to other services, attempt credential reuse via SMB or WinRM
- Check whether the host is also vulnerable to BlueKeep (some Windows 7 dual-boot or legacy systems present alongside modern OS installs)

## Checking for Both BlueKeep and DejaBlue Together

Run both checks using Metasploit auxiliary scanners (safe check, not exploitation):

```bash
# BlueKeep (CVE-2019-0708)
msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS $TARGET_IP; run; exit"

# DejaBlue (CVE-2019-1181)
msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_1181_bluekeep2; set RHOSTS $TARGET_IP; run; exit"
```

If the host is Windows 7 or Server 2008 R2, pivot to the BlueKeep page at [https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708](https://hackindex.io/services/rdp/exploitation/vulnerabilities/bluekeep-cve-2019-0708) which has a reliable exploitation path.

## References

- [CVE-2019-1181](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1181) - Microsoft MSRC Official advisory with affected versions, patch references, and workaround guidance.
- [https://github.com/berodiades/rdpscan](https://github.com/berodiades/rdpscan) -  rdpscan Fast RDP vulnerability scanner covering BlueKeep and DejaBlue family detection.