EUVD-2026-73361
GHSA-r962-7vr2-7cmr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no credentials (PR:N) but victim must connect to attacker server (UI:R); successful overflow yields full process compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow in the Windows Remote Desktop Client (mstsc.exe) enables remote code execution on any Windows system where a user connects to a malicious RDP server. Affected builds span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 - covering virtually the entire current Microsoft desktop and server estate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively initiate an RDP client session connecting to an attacker-controlled server - this is the UI:R condition in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterises a high-severity, network-reachable flaw: an attacker needs no credentials, but the victim must actively connect to the attacker-controlled server - the UI:R condition is the single meaningful barrier to opportunistic exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update addressing CVE-2026-83998, which brings affected systems to the fixed build numbers listed in the affected products above (e.g., Windows 10 22H2 to 10.0.19045.7725 or later, Windows 11 24H2 to 10.0.26100.9445 or later, Windows Server 2025 to 10.0.26100.33438 or later). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016 through 2025 systems with Remote Desktop access enabled, and obtain specific patch details from Microsoft security advisories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today