EUVD-2026-35745
GHSA-26qw-9rj6-9q7x
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a user is enticed to connect to an attacker-controlled RDP server, triggering a heap-based buffer overflow (CWE-122). The flaw scores CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and, while no public exploit is identified at time of analysis, the network-reachable nature and full CIA impact make it a meaningful client-side risk for users connecting to untrusted endpoints.
Technical ContextAI
Microsoft's Remote Desktop Client implements the Remote Desktop Protocol (RDP) over TCP/UDP 3389, parsing a complex stream of virtual-channel, graphics, clipboard, and device-redirection PDUs from the server. CWE-122 (Heap-based Buffer Overflow) indicates that one of these parsers writes attacker-controlled data past the bounds of a heap allocation - typically due to an incorrect length calculation or missing bounds check on a server-supplied field. Because the corruption occurs in the client process, a malicious RDP server (rather than a malicious client) is the threat actor, inverting the usual RDP trust model.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for Remote Desktop Client listed in the MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42992, selecting the KB that matches each affected Windows or Remote Desktop app build. Until patches are deployed, restrict outbound TCP/UDP 3389 (and 443 for RD Gateway tunneled sessions) at the perimeter so endpoints cannot reach untrusted RDP servers, and instruct users not to connect to .rdp files or mstsc links from email or web sources; the trade-off is that legitimate connections to third-party hosted desktops will break and must be allowlisted. Where outbound RDP must remain open, force connections through a Remote Desktop Gateway and disable risky virtual channels (clipboard, drive, device redirection) via Group Policy to reduce the attack surface exposed to a hostile server, accepting the usability loss those redirections provide.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today