EUVD-2026-72976
GHSA-5w2v-mxr4-ch34
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Client-side heap overflow requires the victim to connect telnet.exe to a malicious server, so UI:R; full code execution in user context yields C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows Telnet Client (telnet.exe) stems from a heap-based buffer overflow (CWE-122) that lets an attacker run arbitrary code over the network. All currently-serviced Windows client and server editions - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - are affected until patched. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the optional Windows Telnet Client feature to be installed/enabled (it is NOT present by default on modern Windows) and requires the victim to initiate a Telnet connection from telnet.exe to an attacker-controlled or malicious server - the network path is client-to-server, so despite the vendor's UI:N rating, practical exploitation depends on user-initiated connection to a hostile endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) implies fully remote, unauthenticated, no-interaction exploitation with total system impact - but this is a CLIENT-side flaw: an attacker realistically must lure or coerce a victim into connecting telnet.exe to an attacker-controlled server, which is user interaction (UI:R) that Microsoft's vector does not reflect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the corresponding Microsoft cumulative update that raises telnet.exe to at least the fixed build for each SKU (e.g., 10.0.26100.9445 for Windows 11 24H2, 10.0.19045.7725 for Windows 10 22H2, 10.0.20348.5622 for Server 2022, 10.0.26100.33438 for Server 2025), as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69431 - this is the primary and confirmed fix (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with Telnet Client active using endpoint management or network scanning tools and assess whether the legacy Telnet service is in active use (most organizations can safely disable it). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today