EUVD-2026-35760
GHSA-79cp-qrf9-6hv3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a user is lured into connecting to an attacker-controlled RDP server, where a heap-based buffer overflow (CWE-122) can be triggered to run arbitrary code on the client machine. The flaw was reported by Microsoft (secure@microsoft.com) and carries a CVSS 3.1 score of 7.5, reflecting high attack complexity and the requirement for user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server (UI:R in the CVSS vector), meaning the attacker must socially engineer the user into opening a malicious .rdp file, clicking an rdp:// URI, or otherwise launching the Remote Desktop Client against a hostile endpoint - this is a reverse/client-side attack, not a server-listening RDP exposure like BlueKeep. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, unauthenticated flaw with full CIA impact but tempered by high attack complexity and required user interaction, which is why the base score lands at 7.5 rather than critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious RDP server and lures a target into connecting - typically via a phishing email containing a crafted .rdp file, a malicious link, or a poisoned shortcut on a compromised file share. When the victim's Remote Desktop Client negotiates the session, the rogue server returns a malformed protocol response that overflows a heap buffer in the client, allowing the attacker to execute arbitrary code in the user's context on the victim workstation. … |
| Remediation | Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42993 as the primary fix; exact patched build numbers should be pulled directly from the MSRC update guide for each affected Windows release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Microsoft Remote Desktop Client deployments across the organization; distribute security advisory to users regarding risks of connecting to untrusted servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today