What is the CVSS score of EUVD-2026-35760?

EUVD-2026-35760 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by EUVD-2026-35760?

Microsoft Remote Desktop Client is affected by a critical vulnerability (CVE-2026-42993) enabling remote code execution through user-initiated connections to malicious servers, directly threatening…. A patch is available.

How to fix or mitigate EUVD-2026-35760?

Within 24 hours: Inventory Microsoft Remote Desktop Client deployments across the organization; distribute security advisory to users regarding risks of connecting to untrusted servers. Within 7 days: Deploy endpoint detection and response rules to monitor for suspicious code execution from RDP client processes; enable enhanced logging on all RDP client connections. Within 30 days: Implement firewall policies to restrict RDP client connections to a whitelist of authorized corporate servers; establish weekly vendor checks for patch availability.

Remote Desktop Client EUVD-2026-35760

| CVE-2026-42993 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-79cp-qrf9-6hv3

Buffer Overflow Heap Overflow Microsoft Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:46 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a user is lured into connecting to an attacker-controlled RDP server, where a heap-based buffer overflow (CWE-122) can be triggered to run arbitrary code on the client machine. The flaw was reported by Microsoft (secure@microsoft.com) and carries a CVSS 3.1 score of 7.5, reflecting high attack complexity and the requirement for user interaction. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The Remote Desktop Client is the Microsoft RDP client component used to initiate sessions over the Remote Desktop Protocol, which negotiates virtual channels and exchanges binary structures with a server. CWE-122 (Heap-based Buffer Overflow) indicates that data from the server is written into a heap-allocated buffer without sufficient size validation, corrupting adjacent heap metadata or object pointers. Because the vulnerable code runs in the client process, a malicious RDP server can shape responses (likely within a protocol message, virtual channel, or graphics/clipboard subsystem) to overflow the buffer and divert execution, mirroring the long history of RDP client-side parsing flaws.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42993 as the primary fix; exact patched build numbers should be pulled directly from the MSRC update guide for each affected Windows release. As compensating controls until patching completes, restrict outbound TCP/3389 (and UDP/3389) egress at the perimeter firewall so users cannot connect to arbitrary external RDP servers, enforce an allowlist of trusted internal RDP destinations via Group Policy, and disable or block .rdp file attachments at the email gateway to cut off the most common social-engineering delivery path; note that egress blocking will break legitimate remote-work scenarios that rely on connecting to cloud-hosted RDP/AVD endpoints, so scope exceptions accordingly. Additional vulnerability metadata is mirrored at https://vuldb.com/vuln/369637.