EUVD-2026-35599
GHSA-2mfp-vqrw-7p7v
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled or compromised RDP endpoint, where a race condition (CWE-362) can be triggered to corrupt heap memory and execute arbitrary code in the client process. The flaw is unauthenticated from the network attacker's perspective but requires user interaction to initiate the connection, and no public exploit has been identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively initiate an RDP connection from the vulnerable Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R in CVSS) - the bug is not reachable by an unsolicited inbound packet to a listening client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 base score with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H paints a nuanced picture: full CIA impact and no privileges required, but two friction factors - AC:H (race window must be hit reliably) and UI:R (the victim must initiate or accept the RDP connection) - keep this below worm-class severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a target - for example a sysadmin - into connecting via a phishing email containing a crafted .rdp file or a typosquatted hostname. Once the victim's Remote Desktop Client establishes the session, the rogue server returns specifically timed protocol messages that win the race condition and overflow a heap buffer in the client, yielding code execution in the user's session on the workstation. |
| Remediation | Patch availability and exact fix versions are not enumerated in the provided data, so consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42909 and apply the Patch Tuesday updates listed for each affected Remote Desktop Client SKU (Windows in-box mstsc.exe, Windows App, macOS/iOS/Android Remote Desktop apps) on the relevant platforms. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Restrict RDP connectivity to internal jump hosts or bastion servers only; disable RDP on non-essential systems; implement firewall rules blocking RDP access from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today