Windows Telnet Client CVE-2026-35423

Exploitation requires that the target system has the Windows Telnet Client optional feature installed and enabled - this feature is NOT installed by default on modern Windows 10/11 or Windows Server systems and must be explicitly activated by an administrator or user. Additionally, the victim must actively initiate a Telnet connection (TCP port 23) to an attacker-controlled server; the attacker cannot reach the client without this user-driven action (UI:R in CVSS). The CVSS PR:N indicates no authentication to the target system is required from the attacker's perspective - they simply need to host the malicious Telnet server endpoint. Limiting factors: Telnet Client must be explicitly enabled (non-default), user must voluntarily connect to the malicious endpoint, exploitation is not automatable per CISA SSVC, and the OOB read yields only low confidentiality and low availability impact with no integrity consequence.

Multiple risk signals converge on a low-to-moderate real-world priority. The CVSS base score of 5.4 (Medium) is driven by the network attack vector and zero privilege requirement, but UI:R and the low impact ratings correctly constrain the score. EPSS at 0.05% (16th percentile) indicates near-zero observed exploitation probability across the threat intelligence community. CISA SSVC concurs: Exploitation is rated 'none', Automatable is 'no' (user interaction blocks mass scanning), and Technical Impact is 'partial'. The vulnerability is not listed in CISA KEV. No POC is publicly identified at time of analysis. The primary risk is targeted social engineering - an attacker convincing a user to Telnet to a malicious server - rather than opportunistic mass exploitation. The Telnet Client is an optional Windows feature not installed by default on modern systems, further limiting the realistic attack surface. The CVSS Availability impact of A:L may reflect the potential for the OOB read to crash the client process, but this is non-persistent. Overall, this is a low-priority patching item for most organizations unless Telnet Client is actively used in operational workflows.

An attacker operates a malicious Telnet server and socially engineers a Windows user - for example, via a phishing email referencing a legacy system - into connecting using the Windows Telnet Client. Upon connection, the server transmits a specially crafted response sequence that triggers the out-of-bounds read in the client's protocol parser, potentially leaking a small region of the client process's memory and causing the Telnet session to become unstable or terminate. No public exploit identified at time of analysis, and the requirement for active user initiation prevents automated mass exploitation.