What is the CVSS score of CVE-2026-80074?

CVE-2026-80074 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2026-80074?

Within 24 hours, query your endpoint management system (WSUS, Intune, or configuration management tools) to identify all Windows systems running Remote Desktop client versions below 1.2.7279.0 and establish current baseline. Within 7 days, deploy the vendor patch (Remote Desktop client version 1.2.7279.0 or later) via your standard patch management process, prioritizing systems used for remote access and administrative functions. Within 30 days, verify patch compliance across all identified endpoints through endpoint scanning or registry audits and update your asset inventory to reflect the new baseline.

Remote Desktop Client CVE-2026-80074

Q: Which versions of Remote Desktop Client are affected by CVE-2026-80074?

Microsoft Remote Desktop client (versions 1.2.0.0-1.2.7279.0) contains a heap buffer overflow that enables remote code execution when users connect to compromised or attacker-controlled RDP servers.. A patch is available.

EUVD-2026-73322 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-09-08 secure@microsoft.com

GHSA-5q3q-pwrr-jp7r

Windows Buffer Overflow Heap Overflow Microsoft Remote Desktop Client

8.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Attacker establishes malicious RDP server
Delivery

Delivers crafted .rdp file or link to victim (phishing/redirect)
Exploit

Victim opens connection in vulnerable Remote Desktop client
Execution

Server response triggers heap-based buffer overflow (CWE-122)
Persist

Arbitrary code executed at victim user's privilege level
Impact

Full client session compromise (C:H/I:H/A:H)

Vulnerability Assessment

Weakness	CWE CWE-122 ASVS 5.0 V15 - Secure Coding and Architecture Heap buffer bounds checking MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The victim must be running Microsoft Remote Desktop client for Windows Desktop at a version in the range 1.2.0.0 to 1.2.7279.0 (exclusive). The user must actively initiate an RDP connection to an attacker-controlled server - either by opening a crafted .rdp file, clicking a malicious link, or being redirected via DNS or network interception. No authentication on the client side is required from the attacker (PR:N). Exploitation is bounded by the UI:R requirement: direct server-side or zero-click exploitation is not possible under this vector. Users who only connect to fully trusted, internally-controlled RDP servers face substantially reduced practical risk.
Impact	CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity client-side flaw: network-reachable, low complexity, no attacker privileges required, but contingent on a single user action - initiating the RDP connection. The UI:R requirement meaningfully constrains opportunistic mass exploitation compared to a fully server-side zero-interaction flaw, but phishing or DNS-based redirection can eliminate this barrier at scale; even a mid-sized municipal IT team in sanok should treat this as urgent given that remote work and cloud-desktop infrastructure have normalized RDP client usage well beyond traditional IT perimeters. No CISA KEV listing and no public POC have been identified, so exploitation probability is currently speculative rather than confirmed. EPSS data is not provided in the input, limiting probabilistic triage. The combination of full C/I/A impact and low attack complexity warrants prompt patching, particularly for organizations whose users routinely connect to externally-managed or cloud-hosted desktops.
Exploit ScenarioDerived	An attacker registers a domain and configures a malicious RDP server, then sends a phishing email containing an RDP shortcut file (.rdp) pointing to their server. When the victim opens the file with the vulnerable Remote Desktop client, the client connects and processes the server's malformed response, triggering the heap overflow and granting the attacker arbitrary code execution on the victim's machine.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 08, 2026

Heap-based buffer overflow in Microsoft's Remote Desktop client for Windows Desktop (versions 1.2.0.0 through 1.2.7279.0 exclusive) allows a remote unauthenticated attacker to execute arbitrary code on the client machine when a user connects to an attacker-controlled or compromised RDP server. The flaw carries a CVSS 8.8 with full C/I/A impact, requiring only that the victim initiate an RDP session. No public exploit identified at time of analysis, and a vendor-released patch is available at version 1.2.7279.0.

RemediationAI

Update the Microsoft Remote Desktop client for Windows Desktop to version 1.2.7279.0 or later. The update is available via the Microsoft Store auto-update mechanism or through direct enterprise deployment channels. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80074 should be consulted for deployment guidance. As a compensating control prior to patching, restrict outbound RDP connections (TCP 3389) via firewall policy to an approved allowlist of known-good server IPs, preventing users from connecting to arbitrary or attacker-controlled endpoints. Organizations may also enforce Azure AD Conditional Access or VPN-gated RDP access to reduce exposure to externally-hosted malicious servers. Note that blocking ad-hoc RDP access may impact remote-work workflows and should be communicated to affected users.

Affected VersionsENISA

Remote Desktop client for Windows Desktop 1.2.0.0 <1.2.7279.0

Affected Packages

euvd remote_desktop_client_for_windows_desktop fix: 1.2.7279.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-122 (heap-based buffer overflow) affects the Microsoft Remote Desktop client for Windows Desktop, the modern Store-distributed RDP client distinct from the built-in mstsc.exe. The overflow occurs during processing of server-supplied data over an RDP session, corrupting heap memory in a way that can redirect execution. The affected version range is 1.2.0.0 up to (but not including) 1.2.7279.0, as confirmed by the EUVD (EUVD-2026-73322) affected-versions data. The attack vector is network (AV:N), reflecting that the malicious input originates from a remote RDP server the client has connected to.

Know when Remote Desktop Client gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Client-side network flaw requiring one user action (UI:R); no attacker privileges needed; full compromise of client session with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 08, 2026 - 18:35 EUVD

CVE Published

Sep 08, 2026 - 18:20 nvd

HIGH 8.8

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Articles & Coverage 1

News 9 New Windows Vulnerabilities - 2 Critical, 7 High Severity Sep 09, 2026

Executive ViewAI

Why It Matters

Microsoft Remote Desktop client (versions 1.2.0.0-1.2.7279.0) contains a heap buffer overflow that enables remote code execution when users connect to compromised or attacker-controlled RDP servers. Organizations relying on RDP for remote work, terminal services, or administrative access face risk of silent endpoint compromise across their distributed user base.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 53% exploitable

Prevalence

Medium

modern Store RDP client, popular in Azure/cloud-desktop environments

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.