EUVD-2026-35516
GHSA-q263-xmxv-64c3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client occurs when a user connects to an attacker-controlled RDP server, allowing the server to corrupt heap memory and execute arbitrary code on the client endpoint. The flaw carries a CVSS 8.8 (High) rating reflecting network reach with required user interaction, and no public exploit is identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to initiate an RDP session from the vulnerable Remote Desktop Client to an attacker-controlled or attacker-compromised RDP server - the CVSS UI:R bit confirms user interaction is mandatory, and PR:N confirms the attacker needs no prior credentials on the client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H decomposes to network-reachable, low-complexity, no privileges required, but user interaction required - the user must initiate or accept an RDP session to a malicious server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious RDP server and lures a target - for example, a system administrator - into connecting to it through a phishing email containing an .rdp file, a malicious shortcut on a compromised internal host, or a typosquatted hostname. Once the client establishes the RDP session, the server returns crafted protocol responses that trigger the use-after-free, corrupting the client's heap and executing attacker-supplied code in the user's security context. … |
| Remediation | Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47653 as soon as the patched build is identified for your platform - exact fix versions are not enumerated in the available data and must be pulled from MSRC. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all endpoints running Microsoft Remote Desktop Client; identify users connecting to external or untrusted RDP servers; disable RDP client on endpoints where not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today