EUVD-2026-35756
GHSA-c52c-3v9x-965h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a victim connects to an attacker-controlled or compromised RDP server, triggering a heap-based buffer overflow that runs attacker code in the client's context. The flaw (CWE-416 use-after-free / heap corruption) carries CVSS 8.8 and requires user interaction, with no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must initiate an RDP connection from a vulnerable Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R in the CVSS vector confirms required user interaction such as opening an .rdp file, clicking a rdp:// URI, or manually connecting). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H paints a high-severity remote unauthenticated picture, but the UI:R component is load-bearing: the victim must initiate or accept an RDP connection to a malicious server, so this is not a wormable server-side flaw like BlueKeep. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious RDP server and lures a target - for example via a phishing email with an .rdp attachment, a malicious shortcut, or a watering-hole link - to connect to it. On connection, the rogue server sends crafted RDP protocol data that triggers the heap corruption in the client, executing attacker code in the user's session on the victim workstation. … |
| Remediation | Apply the Microsoft patch referenced in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985 (patch available per vendor advisory; consult the advisory for the exact KB and build numbers per Windows SKU). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an inventory of all Microsoft Remote Desktop Client deployments and affected user populations to quantify organizational exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today