What is the CVSS score of EUVD-2026-35756?

EUVD-2026-35756 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by EUVD-2026-35756?

A remote code execution vulnerability in Microsoft Remote Desktop Client (CVE-2026-42985, CVSS 8.8) enables attackers to compromise user endpoints when employees connect to a malicious or compromised…. A patch is available.

How to fix or mitigate EUVD-2026-35756?

Within 24 hours: Conduct an inventory of all Microsoft Remote Desktop Client deployments and affected user populations to quantify organizational exposure. Within 7 days: Obtain and validate the vendor patch in a test environment to ensure compatibility with business applications and organizational infrastructure. Within 30 days: Complete staged deployment of the patch to all affected endpoints across the organization.

Remote Desktop Client EUVD-2026-35756

| CVE-2026-42985 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-c52c-3v9x-965h

Use After Free Memory Corruption Buffer Overflow Remote Desktop Client Windows App Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:42 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or compromised RDP server, triggering a heap-based buffer overflow that runs attacker code in the client's context. The flaw (CWE-416 use-after-free / heap corruption) carries CVSS 8.8 and requires user interaction, with no public exploit identified at time of analysis. A vendor patch is available via Microsoft MSRC.

Technical ContextAI

The vulnerability resides in the client-side implementation of Microsoft's Remote Desktop Protocol (RDP) handling. While the CWE is officially CWE-416 (Use After Free), the tags and description indicate the manifestation is a heap-based buffer overflow on the connecting client during RDP session negotiation or data channel processing. Memory corruption in the RDP client typically occurs when parsing untrusted server-sent structures (virtual channels, graphics, clipboard, or extension PDUs), where freed heap objects are reused before pointers are invalidated, leading to a controllable heap state attackers can leverage for code execution. The affected component is the Microsoft Remote Desktop Client (mstsc.exe and underlying mstscax.dll / RDP client libraries) - specific affected builds are listed in the MSRC advisory rather than CPE data.

RemediationAI

Apply the Microsoft patch referenced in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985 (patch available per vendor advisory; consult the advisory for the exact KB and build numbers per Windows SKU). As compensating controls until patches are deployed, restrict outbound TCP/3389 and UDP/3389 at the perimeter so users cannot initiate RDP sessions to arbitrary internet hosts (side effect: blocks legitimate remote-to-external-RDP workflows), enforce an RDP allowlist of known-good destination servers via Group Policy or firewall rules, and disable risky virtual channels (clipboard, drive redirection, RemoteFX/graphics extensions) on client machines via the 'Remote Desktop Services' GPO settings - note this degrades clipboard and file-transfer functionality. Additional context is available at https://vuldb.com/vuln/369631.