EUVD-2026-29631
GHSA-27f7-m99f-vqv2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network vector confirmed by Telnet protocol; UI:R required as user must initiate connection; no integrity impact from read-only OOB; A:L reflects potential client crash.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Telnet Client allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Technical ContextAI
The vulnerable component is the Windows Telnet Client, an optional feature (historically telnet.exe) present across a wide range of Windows releases as identified by CPE strings spanning cpe:2.3:a:microsoft:windows_10_version_1607 through cpe:2.3:a:microsoft:windows_server_2012. The root cause is CWE-125 (Out-of-bounds Read): the Telnet protocol parser reads beyond the allocated buffer boundary when processing server-supplied data, enabling disclosure of adjacent memory and potential minor application instability. The CWE-125 class is distinct from a write primitive; it does not directly enable code execution under typical exploitation conditions. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L is consistent with a client-side flaw triggered when a user connects to a crafted server over the network, with no integrity impact and only limited confidentiality and availability consequences.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update corresponding to your Windows version via Windows Update or WSUS; exact fixed builds are documented in the EUVD-2026-29631 and MSRC entries (e.g., Windows 11 22H3/23H2 fixed at 10.0.22631.7079, Windows 10 22H2 fixed at 10.0.19045.7291, Windows Server 2025 fixed at 10.0.26100.32860 - see full version map above). The MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35423 provides the authoritative patch mapping. As a compensating control where patching is not immediately possible, disable the Windows Telnet Client optional feature via 'Turn Windows features on or off' or via DISM ('dism /online /Disable-Feature /FeatureName:TelnetClient'); this eliminates the attack surface entirely but will break any workflows depending on the Telnet Client. Additionally, restrict outbound TCP/23 at the network perimeter to prevent users from initiating Telnet sessions to external or untrusted hosts. Note that Telnet transmits credentials in cleartext regardless of this CVE, so disabling or replacing it with SSH is the recommended long-term posture.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today