CVE-2026-54990 Overview
CVE-2026-54990 is a heap-based buffer overflow vulnerability in the Microsoft Remote Desktop Client. An unauthorized attacker can exploit the flaw to execute arbitrary code over a network when a user connects to a malicious Remote Desktop Protocol (RDP) server. The weakness is tracked under CWE-122 (Heap-based Buffer Overflow) and affects current Windows 11 and Windows Server 2025 platforms. Successful exploitation grants the attacker the ability to run code in the context of the connecting client, compromising confidentiality, integrity, and availability of the host.
Critical Impact
Remote code execution on a client system through a crafted RDP session initiated against an attacker-controlled server.
Affected Products
- Microsoft Windows 11 24H2 (x64, ARM64)
- Microsoft Windows 11 25H2 (x64, ARM64)
- Microsoft Windows 11 26H1 (x64, ARM64)
- Microsoft Windows Server 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-54990 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-54990
Vulnerability Analysis
The vulnerability resides in the Remote Desktop Client component responsible for parsing data received from a Remote Desktop Protocol (RDP) server. A malicious server can return specially crafted response data that overflows a heap-allocated buffer on the client. The overflow corrupts adjacent heap metadata and application objects, enabling an attacker to redirect execution flow. Because the flaw executes in the client process, code runs with the privileges of the connecting user. The attack requires user interaction, since the victim must initiate an RDP connection to the attacker-controlled endpoint.
Root Cause
The root cause is improper validation of the size of attacker-supplied data before it is copied into a heap buffer inside the Remote Desktop Client. When the incoming server data exceeds the allocated buffer size, the client writes past the buffer boundary, corrupting heap structures. This class of defect is classified as CWE-122.
Attack Vector
Exploitation requires an attacker to host a malicious RDP server and lure a user into initiating a connection. Common delivery techniques include phishing emails containing .rdp files, malicious links, or compromised remote-work portals. Once the client connects, the malicious server sends the crafted payload during protocol negotiation or session data exchange, triggering the heap overflow. No prior authentication is required on the client side, and the network attack vector allows remote exploitation across untrusted networks.
No verified public proof-of-concept code is available. Refer to the Microsoft CVE-2026-54990 Advisory for authoritative technical details.
Detection Methods for CVE-2026-54990
Indicators of Compromise
- Outbound RDP connections (TCP/3389 or UDP/3389) from user workstations to untrusted or newly registered external hosts.
- Unexpected mstsc.exe process launches followed by child processes such as cmd.exe, powershell.exe, or rundll32.exe.
- Delivery of .rdp attachment files through email or web downloads immediately preceding an outbound RDP session.
- Crashes or unexpected termination of mstsc.exe with heap corruption exceptions logged in the Windows Application event log.
Detection Strategies
- Monitor process creation telemetry for mstsc.exe spawning shell or scripting interpreters, which is atypical for legitimate RDP client behavior.
- Alert on egress RDP traffic to destinations outside approved corporate address ranges.
- Correlate email or browser download events involving .rdp files with subsequent outbound RDP connections.
Monitoring Recommendations
- Enable Windows Defender Application Control or AppLocker rules that log or block .rdp files originating from untrusted zones.
- Ingest Sysmon Event IDs 1 (process create), 3 (network connect), and 11 (file create) into a centralized SIEM for RDP client activity analysis.
- Track patch compliance for KB updates addressing CVE-2026-54990 across all Windows 11 and Windows Server 2025 assets.
How to Mitigate CVE-2026-54990
Immediate Actions Required
- Apply Microsoft security updates that address CVE-2026-54990 on all affected Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 systems.
- Block outbound TCP/UDP port 3389 traffic at the perimeter firewall except to explicitly approved destinations.
- Warn users against opening .rdp files from unsolicited email, chat messages, or web downloads.
- Enforce email gateway rules that quarantine or strip .rdp file attachments from inbound messages.
Patch Information
Microsoft has released security updates through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-54990 Advisory to identify the specific KB article for each affected build and deploy updates through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.
Workarounds
- Restrict outbound RDP connections to a curated allowlist of internal jump hosts and approved partner systems.
- Route all remote administration through a Remote Desktop Gateway that terminates and inspects RDP sessions before forwarding.
- Use group policy to disable clipboard, drive, and device redirection features that expand the RDP client attack surface.
- Deploy network segmentation to prevent workstations from initiating RDP sessions directly to the internet.
# Block outbound RDP at the Windows host firewall as a temporary control
New-NetFirewallRule -DisplayName "Block Outbound RDP TCP" -Direction Outbound -Protocol TCP -RemotePort 3389 -Action Block
New-NetFirewallRule -DisplayName "Block Outbound RDP UDP" -Direction Outbound -Protocol UDP -RemotePort 3389 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
