EUVD-2026-44001
GHSA-q6cx-465r-334m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Client-side heap RCE reachable over the network from a malicious server but requiring the user to initiate the connection (UI:R), yielding full confidentiality/integrity/availability impact in the user's context.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Remote Desktop Client (RDP client on Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows an unauthorized attacker to run arbitrary code by coercing a victim into connecting to a malicious or attacker-controlled RDP server, which returns crafted data that overflows a heap buffer. Reported by Microsoft with a vendor patch available, it carries CVSS 8.8 and requires user interaction (initiating the connection). EPSS is modest (0.67%, 48th percentile) and there is no public exploit identified at time of analysis, though SSVC rates it automatable with total technical impact.
Technical ContextAI
The flaw is a heap-based buffer overflow (CWE-122) in the client-side component of the Microsoft Remote Desktop Protocol (RDP) - the mstsc/Remote Desktop Client that users run to connect to remote hosts, not the server-side listener. CWE-122 means the client allocates a heap buffer and writes past its bounds when parsing untrusted data received from the RDP server during a session, corrupting adjacent heap metadata or objects and enabling control-flow hijack. The CPE data scopes this to Microsoft desktop and server SKUs (windows_11_version_24h2, 25h2, 26h1, windows_server_2025 including Server Core), all of which ship the built-in RDP client, so the exposure is the outbound client rather than any exposed inbound service.
RemediationAI
Apply the Microsoft security update via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54990 (Vendor-released patch: fixed builds are 10.0.26100.8875 for Windows 11 24H2, 10.0.26200.8875 for 25H2, 10.0.28000.2269 for 26H1, and 10.0.26100.33158 for Windows Server 2025 and its Server Core installation) - the current monthly cumulative update delivers these builds. Because this is a client-side parsing flaw triggered by connecting to a malicious server, the most effective compensating control until patching is to restrict outbound RDP: block outbound TCP/UDP 3389 at the firewall except to known-good internal hosts, and disallow users from connecting to arbitrary or internet-hosted RDP endpoints (the trade-off is that legitimate external RDP workflows, such as connections to cloud VMs on 3389, will break and may need an allowlist). Enforcing RDP connections only through a trusted RD Gateway and user-awareness guidance against opening untrusted .rdp files further reduces exposure without disabling the client entirely.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today