EUVD-2026-35700
GHSA-997j-4mpr-699r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in Microsoft Remote Desktop Client enables remote code execution when a user connects to a malicious RDP server, with the attacker gaining the same privileges as the connecting user. The CVSS 8.8 score reflects network-reachable exploitation requiring only minimal user interaction (initiating an RDP session), and no public exploit has been identified at time of analysis. The flaw is reported by Microsoft Security Response Center (secure@microsoft.com) and is categorized as CWE-122 heap-based buffer overflow.
Technical ContextAI
Remote Desktop Client is Microsoft's client-side implementation of the Remote Desktop Protocol (RDP) used by Windows and other platforms to connect to remote hosts. The vulnerability is rooted in CWE-122 (Heap-Based Buffer Overflow), a memory safety defect in which data written to a heap-allocated buffer exceeds its bounds, corrupting adjacent heap metadata or objects. In RDP client implementations, such overflows typically arise during parsing of server-supplied protocol structures (virtual channels, graphics primitives, clipboard or device redirection data), where attacker-controlled length fields or compressed payloads are processed without adequate bounds checks. Successful corruption of heap state can be steered into arbitrary code execution within the client process. CPE strings are not provided in the input, so the exact product variants and builds must be confirmed via the Microsoft advisory.
RemediationAI
Patch availability is indicated by the linked MSRC update guide entry but no specific fixed build is enumerated in the supplied data - treat this as 'Patch available per vendor advisory' and retrieve the exact fixed versions and KB numbers from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47289, then deploy through Windows Update, WSUS, or Intune/SCCM as appropriate to all endpoints running the Remote Desktop Client. Until patches are rolled out, restrict outbound RDP (TCP/UDP 3389) at the perimeter and host firewalls so clients can only connect to known-good internal RDP servers, which blocks the malicious-server attack path at the cost of breaking ad-hoc connections to external hosts. Additionally, educate users not to launch .rdp files or URIs from untrusted sources (email attachments, web links, chat messages) since user interaction is required, and consider disabling RDP file-association launches or applying AppLocker/WDAC rules to mstsc.exe invocation contexts, accepting the support burden this creates for legitimate remote-work workflows.
More in Windows App
View allRemote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Remote Desktop Client Remote Code Execution Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is remotel
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network. Rated
An elevation of privilege vulnerability exists in Remote Desktop App for Mac in the way it allows an attacker to load un
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows remote unauthenticated attackers to rea
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to rea
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled RD
Remote code execution in Microsoft Remote Desktop Client arises from a heap-based buffer overflow (CWE-122) that an unau
Remote code execution in Microsoft Remote Desktop Client is possible when a user is enticed to connect to an attacker-co
Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled or c
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today