EUVD-2026-99850
GHSA-9842-5rv7-3h5g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious RDP server
-
DeliveryDeliver crafted RDP server response
-
ExploitTrigger use-after-free in client parser
-
ExecutionExecute arbitrary code on client
-
ImpactCompromise victim host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively connect the Windows Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R), which then sends crafted data to trigger the use-after-free during client-side protocol processing; this is a client-initiated, outbound-connection attack, not an attack against a listening RDP service. Limiting factors: mandatory user interaction (initiating/accepting the malicious connection), high attack complexity (AC:H, implying a race or specific memory state must be won), and the requirement that the target be a machine where users initiate RDP sessions to untrusted endpoints. No elevated privileges are needed on the client (PR:N), but the impact is confined to the client host (S:U - scope unchanged). |
| Impact | This is a genuinely high-severity issue by impact (CVSS 7.5, CWE-416 use-after-free yielding C:H/I:H/A:H and SSVC Technical Impact 'total'), but multiple signals converge to indicate it is NOT an urgent, drop-everything priority at time of analysis. The CVSS vector itself tempers the network vector with AC:H (high attack complexity) and UI:R (user interaction required), meaning this is a client-side flaw triggered when a victim connects to an attacker-controlled or compromised RDP endpoint - not a wormable, unauthenticated server-side RCE. CISA SSVC reinforces this: Exploitation 'none' (no observed exploitation) and Automatable 'no' (cannot be reliably mass-exploited), which aligns with the absence of KEV listing and no identified public exploit code. EPSS is NOT provided in the input, so probabilistic exploitation likelihood cannot be quantified. Bottom line: prioritize patching because a patch exists and impact is total, but the practical risk is social-engineering-gated (the user must be induced to connect to a malicious server) and currently unexploited, so this ranks below any unauthenticated or actively-exploited flaw in a remediation queue. |
| Exploit ScenarioDerived | An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim - via phishing link, crafted .rdp file, or rogue connection broker - into connecting with the Windows Remote Desktop Client. The malicious server returns crafted protocol data that triggers a use-after-free in the client, allowing code execution on the victim's machine. No public exploit code has been identified at time of analysis, and the AC:H rating implies non-trivial conditions (e.g., winning a memory-state race) must be met. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.
RemediationAI
Patch status is 'Patch available per vendor advisory' - Microsoft (secure@microsoft.com) has published remediation in the Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69996, and the corresponding builds should be installed through Windows Update, WSUS, or Microsoft Update Catalog; the EUVD affected-version ranges use build numbers as their upper bounds (for example 10.0.19044.7807 for Windows 10 21H2/22H2 and 10.0.26100.9711 for Windows 11 24H2/25H2), which identify the patched servicing baselines to verify against on each branch, but the exact KB identifiers are not included in the supplied data and should be taken from the MSRC advisory. Because the attack is inbound from a rogue RDP server to a connecting client, the most effective compensating control is to prevent clients from reaching untrusted RDP endpoints: apply egress firewall rules that permit TCP/3389 only to known, approved RDP servers, and restrict split-tunnel or unrestricted outbound RDP from user workstations - the trade-off is that legitimate remote administration and BYO-endpoint workflows break and must be re-routed through approved hosts. Where the risk of a compromised upstream RDP endpoint is high, run Remote Desktop sessions from hardened jump hosts or virtualized/throwaway sessions that hold no saved credentials or mapped drives, accepting the loss of convenience and added infrastructure overhead. Additional hardening includes disabling RDP client shortcuts and constraining the client binary (mstsc.exe / the Store Remote Desktop app) with WDAC or AppLocker for users who have no business need for it, and enabling Microsoft Defender Exploit Protection mitigations such as ASLR, CFG, and heap integrity for the client process to make reliable exploitation of the use-after-free harder - noting these are probabilistic mitigations, not a fix. Since user interaction is required, phishing and social-engineering awareness specifically covering 'connect to this RDP address' lures is a useful secondary control; blocking outbound RDP entirely is the strongest mitigation but is impractical wherever remote administration is a core business function.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-416 use-after-free occurring in client-side Remote Desktop Protocol processing within the Windows Remote Desktop Client (mstsc, and related RDP client components). In this bug class, a heap object is freed while a stale pointer to it remains reachable; the attacker-controlled RDP server then induces a reuse of that dangling reference, redirecting execution to memory whose contents the attacker influences - the classic path from use-after-free to remote code execution, with the same primitive also producing the denial-of-service and memory-corruption behavior captured in the tags. The network-attackable rating (AV:N) reflects the fact that the triggering data arrives over the RDP connection, but the direction of trust is inverted: the client dials out to the server, so an attacker must either operate a rogue/compromised RDP endpoint or hijack one that the victim is told to trust (for example via DNS, proxy, or certificate-trust manipulation). AC:H reflects that the attacker must land on a specific heap layout or win a race, and UI:R reflects that a user must initiate or accept the session, which substantially narrows reachability compared with a server-side RDP flaw. Scope is unchanged (S:U), so impact is confined to the connecting client host rather than spreading to connected resources, though a successful compromise of a client with saved credentials or mapped drives would give an attacker a foothold with those resources in reach. Affected builds track the RDP client binaries shipping across the Windows servicing branches enumerated in EUVD.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable but client-initiated against a malicious server, so AV:N with UI:R and AC:H for the required race/memory condition; no prior auth (PR:N) and full host impact gives C/I/A:H, scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A use-after-free flaw in the Windows Remote Desktop Client can let a hostile or compromised RDP server execute code on the workstation of any user who connects to it, creating a potential endpoint compromise path for remote and hybrid workers. Current intelligence indicates no public exploit identified at time of analysis, but the issue carries high severity and total technical impact, and Microsoft has issued a patch per vendor advisory. Security leadership should prioritize patching Windows RDP clients because an exploited client can expose sensitive data and internal network access without requiring attacker privileges on the client.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB