EUVD-2026-29660
GHSA-mp73-9w68-gx32
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an authenticated low-privileged foothold (AV:L, PR:L) with no user interaction; heap overflow yields SYSTEM control, so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
Articles & Coverage 1
AnalysisAI
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Technical ContextAI
The vulnerability resides in the Remote Desktop code paths of the Windows operating system, where memory allocated on the heap is written beyond its bounds (CWE-122, heap-based buffer overflow). Such overflows typically arise when a length or size field is mishandled while copying attacker-influenced data into a fixed or under-sized heap allocation, allowing corruption of adjacent heap metadata or object pointers that can be leveraged to hijack execution and run code in the security context of the vulnerable service. The CPE data confirms the affected surface spans the Microsoft Windows platform broadly - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations - indicating the defect is in shared Remote Desktop OS code rather than an edition-specific feature. Because the SSVC technical impact is rated 'total', successful corruption yields full control of the targeted system.
RemediationAI
Apply the Microsoft security update for CVE-2026-40398 via the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40398), installing at minimum the fixed build for each affected release - for example Windows 10 22H2 build 10.0.19045.7291, Windows 11 24H2 build 10.0.26100.8457, Windows 11 25H2 build 10.0.26200.8457, Windows Server 2022 build 10.0.20348.5139, and Windows Server 2025 build 10.0.26100.32860 (Vendor-released patch: available from Microsoft; consult the advisory for the exact KB per SKU). Since exploitation requires an existing authenticated local foothold, effective compensating controls until patching completes include restricting interactive and Remote Desktop logon rights to trusted administrators, removing unnecessary low-privileged accounts from multi-user and terminal-server hosts, and enforcing least privilege and application allow-listing to limit an attacker's ability to run the exploit code; the trade-off is reduced convenience for shared-host users and additional administrative overhead. These controls reduce but do not eliminate risk, so prioritize the vendor patch. Additional advisory context is available at https://vuldb.com/vuln/363191.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today