What is the CVSS score of CVE-2026-44801?

CVE-2026-44801 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by CVE-2026-44801?

Microsoft Remote Desktop Client contains a remote code execution vulnerability (CVE-2026-44801, CVSS 7.5) that allows arbitrary code execution when users connect to attacker-controlled RDP servers,…. A patch is available.

How to fix or mitigate CVE-2026-44801?

Within 24 hours: Restrict RDP access to trusted internal servers only; disable RDP on non-critical systems; inventory all systems using Microsoft Remote Desktop Client. Within 7 days: Complete organization-wide asset inventory of Remote Desktop Client installations; implement network controls limiting RDP connections to internal corporate servers; enable logging and alerting for RDP traffic. Within 30 days: Establish patch deployment plan for when Microsoft releases a fix; evaluate and pilot alternative remote access solutions to reduce RDP exposure; require multi-factor authentication for all RDP sessions.

Remote Desktop Client CVE-2026-44801

EUVD-2026-35755 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-g3rg-85ff-6538

Use After Free Memory Corruption Buffer Overflow Remote Desktop Client Windows App Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:47 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled RDP server, where a heap-based buffer overflow (linked to use-after-free memory corruption per vendor tags) enables arbitrary code execution on the client machine. The CVSS 7.5 score reflects high attack complexity and required user interaction, and no public exploit identified at time of analysis. SSVC assessment from CISA rates exploitation as 'none' and automatable as 'no', though technical impact is total.

Technical ContextAI

The flaw resides in the Microsoft Remote Desktop Client, the endpoint software that implements the Remote Desktop Protocol (RDP) for connecting to remote Windows hosts. The CWE-416 (Use After Free) classification combined with the 'Heap-based Buffer Overflow' description and vendor tags (Buffer Overflow, Use After Free, Memory Corruption) indicate the root cause is a memory management defect where freed heap memory is referenced again, allowing an attacker controlling the RDP server side of the connection to corrupt heap metadata and adjacent objects. This is a classic client-side memory corruption pattern in protocol parsers, exploited by feeding malformed RDP responses back to a connecting client.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44801 for each affected Windows version and Remote Desktop Client package - patch status is best characterized as 'Patch available per vendor advisory' since the input does not include an exact fix build number, so consult the MSRC update guide to identify the precise KB numbers for your platform. As compensating controls until patches are deployed, restrict outbound RDP (TCP/3389 and UDP/3389) at the network perimeter to only known, trusted destination hosts (trade-off: breaks ad-hoc remote support workflows), require RDP connections through a hardened Remote Desktop Gateway that brokers and validates server identity (trade-off: requires RDG infrastructure), and educate users not to connect to untrusted RDP servers or click .rdp files from email/web (trade-off: relies on user behavior). A secondary advisory entry is tracked at https://vuldb.com/vuln/369639 for cross-reference.