What is the CVSS score of CVE-2026-44799?

CVE-2026-44799 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Remote Desktop Client are affected by CVE-2026-44799?

Microsoft Remote Desktop Client contains a critical vulnerability that could allow attackers to compromise employee systems when remote workers connect to malicious servers, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-44799?

24 hours: Inventory all RDP deployments by criticality level, disable Remote Desktop on non-essential systems, and alert remote workers to avoid connecting to untrusted servers. 7 days: Implement network-level restrictions limiting RDP access to trusted internal networks only, deploy RDP traffic monitoring, and enforce VPN as prerequisite for all RDP sessions. 30 days: Continuously monitor MSRC advisories (support.microsoft.com/msrc) for patch availability and establish expedited deployment procedures to apply patches immediately upon vendor release.

Microsoft Remote Desktop Client CVE-2026-44799

EUVD-2026-35750 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-crj8-fmhj-6r4h

Heap Overflow Buffer Overflow Remote Desktop Client Windows App Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:47 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client arises from a heap-based buffer overflow (CWE-122) that an unauthenticated network attacker can trigger when a victim connects to or interacts with a malicious server. Microsoft (secure@microsoft.com) is the originating reporter and has published an advisory in the MSRC update guide, with no public exploit identified at time of analysis. The CVSS 7.5 (High) rating reflects high attack complexity and required user interaction, but successful exploitation yields full confidentiality, integrity, and availability impact on the client host.

Technical ContextAI

The flaw resides in Microsoft's Remote Desktop Client, the Windows-side component that speaks the Remote Desktop Protocol (RDP) to RDP servers. CWE-122 (Heap-Based Buffer Overflow) indicates that during parsing or handling of attacker-influenced data - typically a server-supplied RDP message, virtual channel payload, or graphics/clipboard structure - the client writes past the bounds of a heap allocation. Such corruption of heap metadata or adjacent objects is the classic primitive used to hijack control flow and achieve arbitrary code execution in the client process context. Specific affected component (mstsc.exe, Remote Desktop app, or a parser DLL) and exact build numbers are not disclosed in the provided data and must be obtained from the MSRC advisory; no CPE strings were supplied.

RemediationAI

Apply the Microsoft security update for CVE-2026-44799 as listed in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44799; patch available per vendor advisory, but a specific fixed build is not included in the provided data and must be read from that advisory and the associated monthly cumulative update for each affected Windows release. As compensating controls until patching completes, instruct users not to initiate RDP sessions to untrusted or unsolicited hosts, block outbound TCP/UDP 3389 (and any custom RDP gateway ports) at the perimeter except to known-good destinations to prevent connections to attacker-controlled servers, and disable or restrict high-risk RDP virtual channels such as clipboard, drive, and device redirection via Group Policy (Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Connection Client) - accepting that this breaks copy/paste and local-resource sharing for legitimate sessions. Routing RDP through a hardened Remote Desktop Gateway limits which servers clients can reach but does not itself stop the parsing bug if the gateway forwards a malicious server response.