EUVD-2026-99854
GHSA-8j3f-hq32-7m8j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to malicious RDP server
-
DeliveryVictim initiates Remote Desktop connection
-
ExploitSend crafted server response triggering use-after-free
-
ExecutionGroom heap to control freed object
-
ImpactExecute arbitrary code as connecting user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively initiate a Remote Desktop Client session to an attacker-controlled or compromised RDP server (UI:R) - it cannot be triggered against a passive, idle client, which rules out unsolicited server-to-client attacks. No authentication is needed on the attacker side (PR:N), but high attack complexity (AC:H) implies the attacker must win a memory-management race or achieve reliable heap grooming of the freed object to gain code execution. Limiting factors: mandatory user interaction, the need to socially engineer a connection to a hostile endpoint, non-deterministic UAF triggering, and the fact that only client builds below the listed patched versions across Windows 10/11 and Windows Server are affected. |
| Impact | This is a client-side use-after-free (CWE-416) in the Windows Remote Desktop Client with a CVSS 3.1 base score of 7.5. The vector (AV:N/AC:H/PR:N/UI:R) shows that although it is network-reachable and needs no privileges, two factors sharply constrain real-world risk: high attack complexity (AC:H), typical of UAF bugs requiring heap grooming or race conditions, and required user interaction (UI:R) - the victim must be lured into connecting to an attacker-controlled RDP endpoint. CISA SSVC reinforces a lower-urgency picture: Exploitation='none' (no observed activity), Automatable='no' (cannot be mass-scripted because a user must be enticed to connect), though Technical Impact='total' matches the C:H/I:H/A:H full-compromise outcome. KEV status is not listed (treat as not in KEV) and no POC is referenced, so this is not currently a widespread or opportunistic threat. Note a tagging/impact tension: the input Tags include 'Denial Of Service', but the description and CWE-416 describe arbitrary code execution with full C/I/A impact, not a DoS - treat the RCE framing from the description/NVD as authoritative. Overall this is a legitimately patch-worthy RCE in a ubiquitous component, but the UI and complexity requirements plus SSVC 'none/no' make it a managed-priority item rather than an emergency, absent any exploitation signal. |
| Exploit ScenarioDerived | An attacker stands up a malicious or compromised RDP server (or uses a crafted .rdp file / link) and socially engineers a user into initiating a Remote Desktop connection to it. Malformed server responses trigger a use-after-free in the client, and successful heap manipulation leads to arbitrary code execution in the context of the connecting user. No public exploit is referenced, and high attack complexity suggests non-trivial reliability engineering would be required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.
RemediationAI
Install the Microsoft security update for CVE-2026-69998 per the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69998), which raises affected systems to the fixed build levels published in the EUVD affected-version data - for example Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2/25H2/26H2 to 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711, Windows 10 1607/1809/21H2 to 10.0.14393.9612, 10.0.17763.9376 and 10.0.19044.7807, and Windows Server 2012/2012 R2/2016/2019/2022/2025 to 6.2.9200.26434, 6.3.9600.23470, 10.0.14393.9612, 10.0.17763.9376, 10.0.20348.5761 and 10.0.26100.33650; Windows 10 and 11 26H1 systems share the same client fix as their corresponding OS build, so verify the installed mstsc binary version after patching. Because the attack only triggers when a user connects out to a hostile RDP endpoint, the effective compensating controls until patching is complete are restricting outbound RDP (TCP 3389 and any custom RDP listener ports) to trusted hosts or through an authenticated gateway such as RD Gateway/VPN - noting the trade-off that this breaks legitimate remote administration and users will need approved jump hosts - and blocking or alerting on unsolicited inbound RDP offers from untrusted networks at the perimeter and host firewall; additionally, where the RDP client is not required on a given endpoint (common on servers), remove or block mstsc.exe via AppLocker/WDAC or Application Control, accepting the operational cost that administrators lose the built-in client and must use an alternative tool. User awareness training to avoid connecting to RDP servers received via email, chat or untrusted links reduces the social-engineering prerequisite, and disabling RDP client clipboard/drive redirection does not mitigate this UAF and should not be relied upon. Monitor for client crashes in mstsc.exe as a potential exploitation indicator, though a crash alone is not proof of compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use-after-free (CWE-416) in the Remote Desktop Client - the mstsc/Windows RDP client stack that parses and processes protocol data received from an RDP server. A freed heap object is dereferenced or reused after release, giving an attacker who controls the server side of the session a memory-corruption primitive that the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) rates as high confidentiality, integrity and availability impact within the client's security context. The AC:H rating reflects the non-deterministic nature of the primitive: the attacker generally needs a race win or precise heap grooming to place controlled data into the reclaimed allocation, and the UI:R rating reflects that the client only processes malicious server responses when a user opens an RDP connection to an attacker-controlled or compromised host. Vendor tags additionally list denial-of-service and memory-corruption outcomes, which is consistent with a UAF whose crash path is easier to reach than the code-execution path, but the authoritative assessment here is remote code execution. Affected software is the Windows Remote Desktop Client shipped with, or installable on, the Windows builds enumerated in the EUVD affected-version data, tied to the MSRC update guide entry for this CVE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered client UAF with no attacker-side auth (PR:N) but mandatory victim connection (UI:R) and heap-race reliability needs (AC:H); successful RCE yields full C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A memory-corruption flaw (use-after-free) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on any Windows machine that connects to it, so an employee who simply starts an outbound RDP session to a hostile endpoint can hand an unauthenticated attacker full control of their workstation. Because every supported Windows client and server build below the patched level is affected, the exposure spans the whole estate rather than one business unit, and the trigger is ordinary user behavior rather than an attacker's ability to reach into our network. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so leadership should treat this as a patch-lag and social-engineering risk to close, not an active incident to contain.
Apply vendor patch. Until deployment completes, restrict outbound RDP (TCP 3389) to allow-listed, trusted destinations, block RDP egress to untrusted internet endpoints, and reinforce user guidance against initiating RDP sessions to unrecognized or unsolicited hosts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB