EUVD-2026-73285
GHSA-h4c5-rp5p-jrmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious RDP endpoint
-
DeliveryClient initiates Remote Desktop connection
-
ExploitServer sends crafted overflow-triggering data
-
ExecutionInteger overflow wraps size calculation
-
ImpactRemote Desktop Client crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Windows Remote Desktop Client (mstsc) component, not a listening service. The victim's client must establish an RDP session to an attacker-controlled or compromised Remote Desktop server, which returns crafted data that triggers the integer overflow. Limiting factors: the flaw is client-side, so the attacker cannot reach victims unsolicited - a user must be induced to connect outbound to the malicious endpoint; impact is confined to a client crash (availability only, C:N/I:N), with no code execution or data exposure. All supported Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server (2016-2025, including Server Core) builds below the patched revisions are affected in default configurations. |
| Impact | This is a network-reachable denial-of-service in the Windows Remote Desktop Client, and the signals converge on genuine-but-moderate risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) shows pure availability impact with no confidentiality or integrity loss - an integer overflow (CWE-190) that crashes the client rather than yielding code execution. Exploitation signals are LOW-to-MODERATE and mutually consistent: EPSS is 0.66% (49th percentile, roughly average), CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial, and there is no KEV listing and no public exploit - no signal indicates active exploitation. One important nuance the CVSS vector understates: this affects the CLIENT component, so realistic exploitation requires the victim to connect (via RDP) to an attacker-controlled or compromised server; MSRC rates this UI:N, but in practice a connection action is the trigger, which lowers real-world exposure below what a server-side unauthenticated flaw would carry. Net: a real, patch-worthy issue given the ubiquitous Windows footprint, but a DoS with a client-side trigger and no exploitation evidence - prioritize via routine Patch Tuesday cadence, not emergency response. |
| Exploit ScenarioDerived | An attacker stands up (or compromises) a malicious RDP server and lures a Windows user into initiating a Remote Desktop connection to it; crafted server-side data triggers an integer overflow in the RDP client, causing the mstsc client to crash. No public exploit code is identified, and the impact is limited to denial of service (client crash) with no confidentiality or integrity effect. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Denial of service in the Windows Remote Desktop Client (mstsc) lets a malicious or compromised RDP server crash the client that connects to it by returning crafted data that triggers an integer overflow or wraparound (CWE-190). All supported Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1) and Windows Server 2016 through 2025 installations, including Server Core, at builds below their patched revisions are affected in default configurations. Because the flaw is client-side, the attacker cannot reach victims unsolicited - the victim must be induced to open an outbound RDP session to an attacker-controlled endpoint; exploitation has not been observed (CISA SSVC: exploitation none, automatable no) and no public exploit code has been identified at time of analysis, with EPSS at 0.66% (49th percentile), so the risk is genuine but moderate and availability-only, with no code execution or data exposure.
Earlier versions of this analysis (1)
Remote Desktop Client on Windows crashes with a denial-of-service condition when a user connects to an attacker-controlled RDP server that triggers a CWE-190 integer overflow or wraparound in the client parsing logic. The flaw affects at least fifteen distinct Windows releases, spanning Windows 10 1607 through Windows 11 26H1 and every Windows Server generation from 2016 through 2025. No active exploitation has been identified; SSVC rates exploitation as none and technical impact as partial, aligning with the availability-only CVSS profile.
RemediationAI
Apply the Microsoft security update that raises each platform to or above its fixed revision: 10.0.14393.9512 for Windows 10 1607 / Server 2016, 10.0.17763.9245 for Windows 10 1809 / Server 2019, 10.0.19044.7725 for Windows 10 21H2, 10.0.19045.7725 for Windows 10 22H2, 10.0.22631.7582 for Windows 11 23H2, 10.0.26100.9445 for Windows 11 24H2, 10.0.26200.9445 for Windows 11 25H2, 10.0.28000.2954 for Windows 11 26H1, 10.0.20348.5622 for Windows Server 2022, and 10.0.26100.33438 for Windows Server 2025; the vendor advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77896 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-77896. Because the vulnerability is client-side and only reachable when a user connects outward to a hostile RDP server, the most effective compensating controls are egress-oriented: restrict outbound TCP/UDP 3389 (and RDP-over-HTTPS gateway destinations on 443 where applicable) to an allow-list of known, trusted corporate RDP hosts at the host firewall or perimeter, accepting that this breaks legitimate remote work to unlisted endpoints and requires ongoing allow-list maintenance; and block or alert on users connecting RDP clients to external or unrecognised hosts via DNS/proxy policy. Where the RDP client is only used to reach a fixed set of internal jump hosts, consider enforcing those destinations through Remote Desktop Gateway or a managed broker so that arbitrary server-supplied payloads from untrusted endpoints cannot reach mstsc. User awareness messaging - not opening RDP connection files (.rdp) or following links that initiate connections to untrusted servers - reduces exposure but is not a reliable control on its own. Restarting mstsc after a crash restores availability, but until the update is applied the client remains repeatedly crashable by the same malicious server.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Remote Desktop Client (mstsc) shipped with Windows, which speaks the Remote Desktop Protocol to a server and processes a large volume of server-supplied structured data (connection negotiation parameters, graphics and input virtual-channel traffic, and length-prefixed payload fields). CWE-190 (Integer Overflow or Wraparound) in that parsing path means an arithmetic operation on a server-controlled value - typically a length, count, or size field - overflows or wraps, producing an incorrect size or offset that is then used in subsequent processing; the practical result in this case is a fault that terminates the client process rather than memory corruption that would enable code execution. The CPE data reflects that the vulnerable code is not a separately installable product but is delivered as an operating-system component, which is why the affected product set is enumerated as Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, and Windows Server 2016/2019/2022/2025 builds. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attack is network-delivered but requires the victim to participate by initiating the RDP connection to the hostile server; impact is confined to availability of the client process, with confidentiality and integrity unaffected.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Client-side flaw triggered when the user connects to a malicious RDP server, so UI:R over Microsoft's UI:N; unauthenticated network trigger, availability-only impact (A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Integer overflow or wraparound in Remote Desktop Client allows an unauthorized attacker to deny service over a network.
Executive ViewAI
The Windows Remote Desktop Client (mstsc) contains a denial-of-service vulnerability that can crash the client when a user connects to a malicious or compromised RDP server, disrupting remote work sessions. This affects all supported Windows 10, Windows 11, and Windows Server installations, so organizations with remote or hybrid workforces are at risk if employees initiate outbound RDP connections to untrusted endpoints. While no public exploit code has been identified and exploitation has not been observed, the widespread use of RDP and the availability impact warrant prompt patching to maintain operational continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB