CVE-2026-40398: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-40398 Overview

CVE-2026-40398 is a heap-based buffer overflow vulnerability in Windows Remote Desktop that enables local privilege escalation. An authorized attacker with low privileges can corrupt heap memory to execute code in a higher-privileged context. The flaw is tracked under [CWE-122: Heap-based Buffer Overflow] and affects a broad set of Windows client and server releases, from Windows 10 1607 through Windows Server 2025. Microsoft has published an advisory through the Microsoft Security Update Guide. The vulnerability requires local access and no user interaction, and successful exploitation impacts confidentiality, integrity, and availability.

Critical Impact

A locally authenticated attacker can corrupt heap memory in Windows Remote Desktop to gain SYSTEM-level privileges on affected Windows clients and servers.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
• Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-40398 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-40398

Vulnerability Analysis

The vulnerability resides in the Windows Remote Desktop component and manifests as a heap-based buffer overflow [CWE-122]. When the affected code path processes attacker-influenced input, it writes beyond the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap structures, including object headers, function pointers, or pointer tables used by privileged Remote Desktop services.

Because Remote Desktop components execute with elevated privileges, controlled corruption of heap metadata enables a local attacker to redirect execution flow. The end result is code execution in the context of a higher-privileged process, achieving local elevation of privilege.

Root Cause

The root cause is improper validation of length or size parameters before copying data into a heap allocation within Remote Desktop logic. The component fails to enforce the boundary between attacker-supplied data size and destination buffer capacity. Microsoft has not released a public technical breakdown of the specific function, and details remain in the vendor advisory.

Attack Vector

Exploitation requires local access and low-level authenticated privileges on the target system. No user interaction is necessary. An attacker first obtains a foothold as a standard user, then invokes the vulnerable Remote Desktop code path with crafted input to trigger the overflow. Successful exploitation yields privilege escalation to SYSTEM, allowing the attacker to install programs, modify data, or create new accounts with full rights.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.027%, indicating low predicted near-term exploitation activity. See the Microsoft Security Update Guide for vendor-specific technical context.

Detection Methods for CVE-2026-40398

Indicators of Compromise

• Unexpected crashes of svchost.exe or Remote Desktop service processes (TermService, SessionEnv, UmRdpService) with heap corruption error codes such as STATUS_HEAP_CORRUPTION (0xC0000374).
• Standard user processes spawning child processes running as NT AUTHORITY\SYSTEM shortly after interacting with Remote Desktop components.
• Anomalous loading of Remote Desktop client or server DLLs (mstscax.dll, rdpcorets.dll, termsrv.dll) by non-standard user processes.

Detection Strategies

• Monitor Windows Error Reporting and Application Event Log entries for crashes in Remote Desktop service binaries, which can indicate exploitation attempts that fail before achieving control.
• Hunt for process lineage anomalies where low-privilege user sessions produce SYSTEM-level child processes without a legitimate scheduled task or service trigger.
• Correlate Sysmon Event ID 1 (process creation) and Event ID 10 (process access) involving lsass.exe or Remote Desktop services to surface post-exploitation behavior.

Monitoring Recommendations

• Enable command-line auditing and PowerShell script block logging on all RDP-enabled hosts to capture post-escalation activity.
• Stream endpoint telemetry to a centralized data lake or SIEM for behavioral correlation across users and hosts, including process token elevation events.
• Alert on creation of new local administrators, service installations, or scheduled tasks immediately following Remote Desktop service exceptions.

How to Mitigate CVE-2026-40398

Immediate Actions Required

• Apply the May 2026 Microsoft security updates to all affected Windows client and server systems as published in the Microsoft Security Update Guide.
• Prioritize patching on multi-user systems, jump hosts, Remote Desktop Session Hosts, and Virtual Desktop Infrastructure where many low-privilege users have local logon rights.
• Audit local user accounts and remove unnecessary interactive logon privileges to reduce the population of accounts that could trigger the local attack vector.

Patch Information

Microsoft has issued patches for all affected Windows builds, including Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through 2025. Refer to the vendor advisory at the Microsoft Security Update Guide for the specific KB article and build numbers applicable to each Windows version in your environment.

Workarounds

• If patching must be delayed, restrict local interactive logon and Remote Desktop access to trusted administrators only via Group Policy (Allow log on locally and Allow log on through Remote Desktop Services).
• Disable the Remote Desktop Services (TermService) on systems where it is not required, eliminating the vulnerable code path.
• Enforce application allowlisting through Windows Defender Application Control or AppLocker to limit which binaries unprivileged users can execute against Remote Desktop components.

# Configuration example: disable Remote Desktop where not required
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
Stop-Service -Name TermService -Force
Set-Service -Name TermService -StartupType Disabled