CVE-2026-80074: Remote Desktop Client RCE Vulnerability

CVE-2026-80074 Overview

CVE-2026-80074 is a heap-based buffer overflow [CWE-122] in Microsoft Remote Desktop Client. An unauthorized attacker can execute arbitrary code over a network by convincing a targeted user to connect to a malicious Remote Desktop Protocol (RDP) server. The flaw is tracked with a CVSS 3.1 score of 8.8 and requires user interaction to trigger the vulnerable code path in the client.

Successful exploitation grants the attacker code execution in the context of the user running the RDP client, leading to full compromise of confidentiality, integrity, and availability on the victim host.

Critical Impact
A malicious RDP server can trigger a heap corruption in the client and run attacker-controlled code on the connecting workstation.

Affected Products

Microsoft Remote Desktop Client (see the Microsoft Security Update Guide for the authoritative build list)
Windows platforms shipping the affected Remote Desktop Client component
Any environment where users initiate outbound RDP connections to untrusted hosts

Discovery Timeline

2026-09-08 - CVE-2026-80074 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80074

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] in the Remote Desktop Client. The client mishandles the size of data received from a Remote Desktop Protocol server, writing past the bounds of a heap allocation during message parsing.

Because the attack targets the client, exploitation requires that a user initiate an RDP session to an attacker-controlled endpoint. Once connected, the malicious server delivers a crafted protocol response that triggers the overflow inside the client process.

The overflow corrupts adjacent heap metadata or object pointers, allowing an attacker to influence control flow and execute code with the privileges of the logged-in user. The CWE-122 classification indicates the corruption occurs on the process heap rather than the stack, requiring heap grooming techniques for reliable exploitation.

Root Cause

The root cause is missing or insufficient bounds validation on server-supplied data before it is copied into a heap buffer. The client trusts length or offset fields provided by the remote endpoint, producing an out-of-bounds write when those values exceed the allocated buffer size.

Attack Vector

The attack vector is network-based with user interaction required. An attacker hosts a malicious RDP service and lures a target to connect through phishing, a rogue link, a compromised RDP shortcut file, or a man-in-the-middle position against a legitimate server. After the client initiates the session, the server sends malformed protocol data that triggers the heap overflow and hijacks execution flow inside the client process.

The vulnerability is described in prose because no public proof-of-concept code has been released. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-80074

Indicators of Compromise

Outbound RDP (TCP/3389 or UDP/3389) connections from workstations to unusual, external, or newly registered IP addresses and domains.
Crashes, unexpected terminations, or Windows Error Reporting entries for mstsc.exe or related Remote Desktop client binaries.
Child processes spawned by mstsc.exe such as command shells, scripting engines, or LOLBins immediately after an RDP session starts.
Delivery of .rdp configuration files via email, chat, or drive-by download pointing at attacker-controlled hosts.

Detection Strategies

Alert on any process spawned by mstsc.exe that is not part of expected administrator workflows, especially cmd.exe, powershell.exe, rundll32.exe, or regsvr32.exe.
Correlate RDP client crashes with subsequent process creation or network activity to identify potential post-exploitation behavior.
Baseline expected RDP destinations per user and flag connections to hosts outside that baseline, particularly external ASNs.

Monitoring Recommendations

Ingest Sysmon Event IDs 1, 3, and 11 alongside Microsoft-Windows-TerminalServices-ClientActiveXCore logs into a central SIEM for retrospective hunting.
Monitor egress firewall logs for RDP traffic leaving the corporate perimeter, which is uncommon in most environments.
Track distribution of .rdp files through email security gateways and endpoint file-write telemetry.

How to Mitigate CVE-2026-80074

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all systems running the Remote Desktop Client.
Block outbound RDP (TCP/UDP 3389) at the perimeter firewall unless explicitly required for business workflows.
Warn users against opening .rdp files from untrusted sources and connecting to unfamiliar RDP hosts.

Patch Information

Microsoft has published a security update for CVE-2026-80074. Consult the Microsoft Security Update Guide for affected build numbers and the corresponding KB articles, then deploy through Windows Update, WSUS, Intune, or your preferred patch management platform.

Workarounds

Restrict outbound RDP connections to a defined allowlist of internal jump hosts and known partner endpoints.
Enforce use of Remote Desktop Gateway or a Zero Trust access broker so clients never connect directly to arbitrary servers.
Disable or filter delivery of .rdp file attachments at the email gateway.
Apply application control policies (WDAC, AppLocker) to block execution of child processes from mstsc.exe outside approved administrative tooling.

bash

# Block outbound RDP on Windows endpoints using PowerShell
New-NetFirewallRule -DisplayName "Block Outbound RDP TCP" `
  -Direction Outbound -Protocol TCP -RemotePort 3389 -Action Block

New-NetFirewallRule -DisplayName "Block Outbound RDP UDP" `
  -Direction Outbound -Protocol UDP -RemotePort 3389 -Action Block