EUVD-2026-44307
GHSA-h9cr-8qw2-fhg7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable RDS service, low complexity and no user interaction, but requires a low-privilege authenticated foothold (PR:L); memory-corruption RCE yields full C/I/A impact within an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows Remote Desktop Services (RDS) allows an authenticated network attacker to run arbitrary code by triggering a use-after-free (CWE-416) memory corruption condition. The flaw affects a broad range of currently-supported Windows client and server builds - Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2022/2025 (including Server Core). It was reported by Microsoft with a CVSS 8.8 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network vector combined with only low-privilege requirements makes it a strong patch priority.
Technical ContextAI
Remote Desktop Services (RDS, formerly Terminal Services) is the Windows subsystem that brokers RDP sessions, hosting remote graphical logons and session management over TCP 3389 (and RDP-over-UDP). The root cause is a use-after-free (CWE-416): the service continues to reference a heap object after it has been freed, allowing an attacker who can influence the reallocated memory to corrupt control-flow data and achieve code execution in the context of the RDS process. Per the supplied CPE data, the affected code is present across Microsoft's mainstream servicing branches - windows_10_version_21h2/22h2, windows_11_version_24h2/25h2/26h1, and windows_server_2022 and windows_server_2025 including the Server Core installation - indicating a shared component in the RDS/RDP stack rather than an edition-specific bug. The tags additionally flag a Denial Of Service impact facet, consistent with memory-corruption bugs that can crash the service before or instead of achieving full RCE.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-58626 via Windows Update / WSUS / your patch-management tooling, selecting the cumulative update that matches each affected branch (Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2022/2025 and Server Core); exact per-build fixed versions are listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58626. Where immediate patching is not possible, reduce exposure by restricting who can reach the RDS listener: block or firewall TCP/UDP 3389 at the network edge and place RDP behind a Remote Desktop Gateway or VPN so only trusted, authenticated networks can connect (trade-off: may disrupt legitimate remote administration workflows). Enforce Network Level Authentication (NLA) to require authentication before a session is established, and limit Remote Desktop Users group membership to reduce the pool of low-privilege accounts that could satisfy the PR:L precondition (trade-off: NLA does not fully eliminate risk if the attacker already holds valid credentials). On servers that do not require the role, disable Remote Desktop Services entirely.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today