CVE-2026-77896: Remote Desktop Client DOS Vulnerability

CVE-2026-77896 Overview

CVE-2026-77896 is an integer overflow vulnerability [CWE-190] in the Microsoft Remote Desktop Client. A network-based attacker can trigger a wraparound condition that causes the client to terminate, denying service to the affected user. Exploitation requires user interaction, meaning a target must connect to an attacker-controlled Remote Desktop Protocol (RDP) endpoint or accept a malicious connection request. The flaw does not expose confidentiality or integrity of client data, but it produces a high-impact availability condition on the affected host.

Critical Impact
A remote, unauthenticated attacker can crash the Remote Desktop Client after a user initiates an RDP session, disrupting remote access workflows.

Affected Products

Microsoft Remote Desktop Client (see the Microsoft Security Update Guide for the definitive product and build list)
Windows platforms shipping the affected client component
Downstream Microsoft Remote Desktop distributions tracked under the same advisory

Discovery Timeline

2026-09-08 - CVE-2026-77896 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77896

Vulnerability Analysis

The vulnerability is an integer overflow or wraparound condition in the Remote Desktop Client. When the client parses attacker-controlled protocol data during an RDP session, an arithmetic operation exceeds the storage capacity of its integer type. The resulting wraparound corrupts length, offset, or allocation calculations used downstream. The client then enters an inconsistent state and terminates, producing a denial-of-service condition on the endpoint hosting the client.

Because the impact is limited to availability, the attacker cannot read session data or modify content processed by the client. The disruption still matters in environments that depend on RDP for administrative access, jump-host workflows, or virtual desktop delivery. Repeated exploitation can prevent operators from re-establishing sessions until the malicious server or payload is removed.

Root Cause

The root cause is unchecked arithmetic on a size or index value derived from network input, categorized as [CWE-190] Integer Overflow or Wraparound. The client trusts a value that can be manipulated by the peer and uses it without validating that subsequent calculations remain within valid bounds. Once the value wraps, the client operates on corrupted state and crashes.

Attack Vector

An attacker stands up a malicious RDP server or coerces a victim to connect to one, often through a crafted .rdp file, phishing link, or web-based launcher. When the client negotiates or processes protocol data from that endpoint, the malformed value triggers the overflow. No credentials are required on the server side, and the attacker does not need pre-existing access to the victim host. The Microsoft Security Update Guide is the authoritative reference for the affected components and exploitation preconditions (Microsoft Security Update Guide).

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-77896

Indicators of Compromise

Unexpected termination of mstsc.exe or the Microsoft Remote Desktop application shortly after establishing a session
Windows Application or WER (Windows Error Reporting) crash events referencing the Remote Desktop Client process
Outbound RDP connections (TCP 3389 or configured alternates) to untrusted or newly registered hosts followed by client crashes

Detection Strategies

Correlate client-side process crash telemetry with recent outbound RDP session establishment to identify overflow-triggered failures
Alert on execution of .rdp files delivered through email attachments, browser downloads, or messaging platforms
Monitor for repeated RDP connection attempts from user endpoints to the same external destination, particularly when followed by process termination

Monitoring Recommendations

Ingest endpoint process, network, and crash telemetry into a centralized analytics platform for cross-source correlation
Track RDP client versions across the fleet to prioritize hosts running unpatched builds
Baseline normal RDP destinations per user or business unit and flag deviations to external or newly observed hosts

How to Mitigate CVE-2026-77896

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-77896 as listed in the Microsoft Security Update Guide as soon as validation permits
Restrict outbound RDP connectivity from user endpoints to approved internal destinations using host or network firewalls
Instruct users not to open .rdp files from untrusted sources and to verify RDP hosts before connecting

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Update Guide. Administrators should identify affected client builds in their environment and deploy the vendor-provided update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or their standard patch management tooling.

Workarounds

Block outbound TCP 3389 and any alternate RDP ports at the perimeter for user segments that do not require external RDP access
Route all remote administrative access through a Remote Desktop Gateway or bastion host with strict allow-listing
Disable auto-launch handlers for .rdp files in email and browser clients until the patch is deployed

bash

# Configuration example: block outbound RDP on Windows endpoints
New-NetFirewallRule -DisplayName "Block Outbound RDP (CVE-2026-77896)" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 3389 `
  -Action Block `
  -Profile Any