EUVD-2026-35519
GHSA-q5rf-fgxq-r728
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible via a heap-based buffer overflow that an unauthenticated remote attacker can trigger when a user is convinced to connect to a malicious RDP server. The flaw is rated CVSS 7.5 (High) with attack complexity High and required user interaction, and no public exploit identified at time of analysis. The CWE-416 classification combined with the vendor's tags points to a use-after-free condition reachable through crafted RDP server responses.
Technical ContextAI
Remote Desktop Client is the Microsoft RDP client component used on Windows and other platforms to initiate Remote Desktop Protocol sessions to remote hosts. The root cause is CWE-416 (Use After Free), which the vendor tags further characterize as a heap-based buffer overflow / memory corruption - a freed heap object is referenced again, allowing an attacker who controls server-side RDP traffic to corrupt heap metadata or adjacent allocations and steer execution. Because the vulnerable surface is the client's parsing/state-handling of server responses during a session, exploitation occurs in the client process context rather than against a listening service.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48563 as the primary fix; exact patched build numbers were not provided in the input and should be retrieved from that advisory at deployment time (patch available per vendor advisory). As compensating controls until patches are deployed, restrict outbound TCP 3389 (and UDP 3389) at the perimeter so endpoints can only connect to known internal RDP hosts, which prevents drive-by connections to attacker-controlled servers but breaks legitimate external RDP use; train users not to accept RDP connection prompts from unverified .rdp files or links (low operational cost, low assurance); and where feasible route RDP through an RD Gateway or Azure Bastion, which terminates the client's direct exposure to arbitrary servers at the cost of additional infrastructure.
More in Windows 10 1809
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Rated critical severity (CVSS 9.8), thi
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Same weakness CWE-416 – Use After Free
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today