EUVD-2026-35518
GHSA-w5f2-x256-q5rw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or compromised RDP server, triggering a heap-based buffer overflow that leads to arbitrary code execution on the client machine. The flaw is unauthenticated from the server side but requires user interaction and high attack complexity, and no public exploit identified at time of analysis. CVSS is rated 7.5 (High) with confidentiality, integrity, and availability impact.
Technical ContextAI
Remote Desktop Client is Microsoft's implementation of the Remote Desktop Protocol (RDP) used by Windows endpoints to connect to RDP-enabled hosts. The vulnerability is classified under CWE-416 (Use After Free), and the tags also indicate heap-based buffer overflow and memory corruption - typical of RDP-channel parsing flaws where the client mishandles freed heap objects when processing attacker-controlled data returned by a malicious RDP server. Exploitation of such memory corruption in the client process can lead to control of execution flow and code execution in the user's session context.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654 via Windows Update or WSUS as soon as practical. As compensating controls until patches are deployed, restrict outbound RDP (TCP/3389 and UDP/3389) at the perimeter and host firewalls so clients cannot initiate connections to untrusted servers, and use Group Policy or AppLocker to limit which RDP endpoints users may connect to; both controls reduce exposure but break legitimate connections to external or jump-host RDP services and require an allowlist. Train users not to launch .rdp files from email or web sources, since exploitation requires the victim to initiate a connection to an attacker-controlled server.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today