What is the CVSS score of CVE-2026-47289?

CVE-2026-47289 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by CVE-2026-47289?

Microsoft Remote Desktop Client contains a high-severity flaw that could allow attackers to take complete control of employee systems when users connect to a malicious RDP server.. A patch is available.

How to fix or mitigate CVE-2026-47289?

Within 24 hours: Identify all systems running Microsoft Remote Desktop Client and audit which employees require RDP access; disable RDP on systems where it is not business-critical and restrict remaining RDP access to trusted internal networks via firewall rules. Within 7 days: Enforce multi-factor authentication for all RDP sessions and implement network monitoring for suspicious connection patterns; document baseline RDP usage. Within 30 days: Monitor Microsoft Security Response Center daily for patch release; prepare a tested deployment and rollout plan for rapid patching once available.

Remote Desktop Client CVE-2026-47289

EUVD-2026-35700 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-997j-4mpr-699r

Buffer Overflow Heap Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows App Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:57 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Heap-based buffer overflow in Microsoft Remote Desktop Client enables remote code execution when a user connects to a malicious RDP server, with the attacker gaining the same privileges as the connecting user. The CVSS 8.8 score reflects network-reachable exploitation requiring only minimal user interaction (initiating an RDP session), and no public exploit has been identified at time of analysis. The flaw is reported by Microsoft Security Response Center (secure@microsoft.com) and is categorized as CWE-122 heap-based buffer overflow.

Technical ContextAI

Remote Desktop Client is Microsoft's client-side implementation of the Remote Desktop Protocol (RDP) used by Windows and other platforms to connect to remote hosts. The vulnerability is rooted in CWE-122 (Heap-Based Buffer Overflow), a memory safety defect in which data written to a heap-allocated buffer exceeds its bounds, corrupting adjacent heap metadata or objects. In RDP client implementations, such overflows typically arise during parsing of server-supplied protocol structures (virtual channels, graphics primitives, clipboard or device redirection data), where attacker-controlled length fields or compressed payloads are processed without adequate bounds checks. Successful corruption of heap state can be steered into arbitrary code execution within the client process. CPE strings are not provided in the input, so the exact product variants and builds must be confirmed via the Microsoft advisory.

RemediationAI

Patch availability is indicated by the linked MSRC update guide entry but no specific fixed build is enumerated in the supplied data - treat this as 'Patch available per vendor advisory' and retrieve the exact fixed versions and KB numbers from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47289, then deploy through Windows Update, WSUS, or Intune/SCCM as appropriate to all endpoints running the Remote Desktop Client. Until patches are rolled out, restrict outbound RDP (TCP/UDP 3389) at the perimeter and host firewalls so clients can only connect to known-good internal RDP servers, which blocks the malicious-server attack path at the cost of breaking ad-hoc connections to external hosts. Additionally, educate users not to launch .rdp files or URIs from untrusted sources (email attachments, web links, chat messages) since user interaction is required, and consider disabling RDP file-association launches or applying AppLocker/WDAC rules to mstsc.exe invocation contexts, accepting the support burden this creates for legitimate remote-work workflows.