What is the CVSS score of CVE-2026-47654?

CVE-2026-47654 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by CVE-2026-47654?

Microsoft Remote Desktop Client is vulnerable to remote code execution (CVE-2026-47654) when users connect to attacker-controlled or compromised RDP servers, with no authentication required from the…. A patch is available.

How to fix or mitigate CVE-2026-47654?

24 hours: Inventory RDP client installations across the organization and implement enhanced monitoring for suspicious RDP connections and anomalous server behaviors. 7 days: Deploy compensating controls including network firewall restrictions on RDP traffic, multi-factor authentication enforcement for all RDP sessions, and enablement of Network Level Authentication (NLA). 30 days: Establish expedited patch deployment process and prepare for Microsoft Remote Desktop Client updates upon vendor release.

Remote Desktop Client CVE-2026-47654

EUVD-2026-35518 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-w5f2-x256-q5rw

Use After Free Memory Corruption Buffer Overflow Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.6

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.6 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:51 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or compromised RDP server, triggering a heap-based buffer overflow that leads to arbitrary code execution on the client machine. The flaw is unauthenticated from the server side but requires user interaction and high attack complexity, and no public exploit identified at time of analysis. CVSS is rated 7.5 (High) with confidentiality, integrity, and availability impact.

Technical ContextAI

Remote Desktop Client is Microsoft's implementation of the Remote Desktop Protocol (RDP) used by Windows endpoints to connect to RDP-enabled hosts. The vulnerability is classified under CWE-416 (Use After Free), and the tags also indicate heap-based buffer overflow and memory corruption - typical of RDP-channel parsing flaws where the client mishandles freed heap objects when processing attacker-controlled data returned by a malicious RDP server. Exploitation of such memory corruption in the client process can lead to control of execution flow and code execution in the user's session context.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654 via Windows Update or WSUS as soon as practical. As compensating controls until patches are deployed, restrict outbound RDP (TCP/3389 and UDP/3389) at the perimeter and host firewalls so clients cannot initiate connections to untrusted servers, and use Group Policy or AppLocker to limit which RDP endpoints users may connect to; both controls reduce exposure but break legitimate connections to external or jump-host RDP services and require an allowlist. Train users not to launch .rdp files from email or web sources, since exploitation requires the victim to initiate a connection to an attacker-controlled server.