EUVD-2026-44303
GHSA-f6c4-f6g4-38mq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable pre-auth RDP RCE with no user interaction yields AV:N/AC:L/PR:N/UI:N and total C/I/A; unchanged scope as code runs in the RDP service context.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows Remote Desktop Protocol allows an unauthorized, unauthenticated network attacker to run arbitrary code by triggering an integer overflow (CWE-190) in RDP processing. The flaw carries a CVSS 9.8 and affects a broad range of Windows client and server builds from Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is a modest 0.78% (52nd percentile), so risk is currently theoretical but severe if weaponized.
Technical ContextAI
The Remote Desktop Protocol is Microsoft's proprietary protocol (typically TCP/UDP 3389) that provides graphical remote-session access and is implemented across all supported Windows editions. The root cause is CWE-190, an integer overflow or wraparound: a length, size, or index calculation in the RDP code path wraps past its maximum value, producing an undersized allocation or miscomputed bounds that leads to an out-of-bounds/buffer overflow - the tags explicitly pair 'Integer Overflow' with 'Buffer Overflow'. The CPE data confirms the affected surface is the Microsoft Windows RDP stack across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations, indicating the vulnerable code lives in a shared, long-lived RDP component rather than an edition-specific feature.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-58594 referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58594, upgrading to at least the fixed build for your edition (for example 10.0.19045.7548 for Windows 10 22H2, 10.0.20348.5386 for Server 2022, 10.0.26100.8875 for Windows 11 24H2/25H2, 6.3.9600.23291 for Server 2012 R2, and 10.0.14393.9339 for Server 2016/1607). Until patches are deployed, reduce exposure of the RDP service: restrict TCP/UDP 3389 to trusted management networks or require access through a VPN or RD Gateway, and block 3389 at the perimeter firewall (trade-off: breaks direct external remote-desktop access and any tooling that relies on it). Enabling Network Level Authentication forces authentication before the pre-auth RDP session negotiation, which can raise the bar for reaching the vulnerable code path, though it does not fully substitute for patching and requires clients that support NLA. Where RDP is not needed, disable Remote Desktop entirely.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today