EUVD-2026-35760
GHSA-79cp-qrf9-6hv3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Remote Desktop Client is possible when a user is lured into connecting to an attacker-controlled RDP server, where a heap-based buffer overflow (CWE-122) can be triggered to run arbitrary code on the client machine. The flaw was reported by Microsoft (secure@microsoft.com) and carries a CVSS 3.1 score of 7.5, reflecting high attack complexity and the requirement for user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The Remote Desktop Client is the Microsoft RDP client component used to initiate sessions over the Remote Desktop Protocol, which negotiates virtual channels and exchanges binary structures with a server. CWE-122 (Heap-based Buffer Overflow) indicates that data from the server is written into a heap-allocated buffer without sufficient size validation, corrupting adjacent heap metadata or object pointers. Because the vulnerable code runs in the client process, a malicious RDP server can shape responses (likely within a protocol message, virtual channel, or graphics/clipboard subsystem) to overflow the buffer and divert execution, mirroring the long history of RDP client-side parsing flaws.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42993 as the primary fix; exact patched build numbers should be pulled directly from the MSRC update guide for each affected Windows release. As compensating controls until patching completes, restrict outbound TCP/3389 (and UDP/3389) egress at the perimeter firewall so users cannot connect to arbitrary external RDP servers, enforce an allowlist of trusted internal RDP destinations via Group Policy, and disable or block .rdp file attachments at the email gateway to cut off the most common social-engineering delivery path; note that egress blocking will break legitimate remote-work scenarios that rely on connecting to cloud-hosted RDP/AVD endpoints, so scope exceptions accordingly. Additional vulnerability metadata is mirrored at https://vuldb.com/vuln/369637.
More in Windows 10 21h2
View allWindows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. Rated critical severity (CVSS 9.8), thi
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today