CVE-2026-80077: Remote Desktop Client RCE Vulnerability

CVE-2026-80077 Overview

CVE-2026-80077 is a heap-based buffer overflow [CWE-122] in the Microsoft Remote Desktop Client. The flaw allows an unauthorized attacker to execute arbitrary code over a network when a user connects to an attacker-controlled Remote Desktop Protocol (RDP) server. Exploitation requires user interaction, typically convincing a victim to initiate an RDP connection to a malicious endpoint. Successful exploitation results in code execution in the context of the client process, compromising confidentiality, integrity, and availability of the target host.

Critical Impact
A remote attacker operating a malicious RDP server can execute arbitrary code on a connecting client, enabling initial access, lateral movement, and full endpoint compromise.

Affected Products

Microsoft Remote Desktop Client (specific affected builds listed in the vendor advisory)
Windows platforms shipping the vulnerable Remote Desktop Client component
Refer to the Microsoft Security Update Guide for the complete component and version matrix

Discovery Timeline

2026-09-08 - CVE-2026-80077 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80077

Vulnerability Analysis

The vulnerability resides in the Microsoft Remote Desktop Client and stems from improper bounds checking when parsing server-supplied data during an RDP session. A malicious RDP server can return crafted protocol messages that cause the client to write beyond an allocated heap buffer. This corruption of adjacent heap metadata or object pointers can be shaped into an arbitrary code execution primitive within the client process.

Because the vulnerable code path executes during connection handling, exploitation requires only that a user connect to an attacker-controlled server. The attacker does not need valid credentials on the target system. The scope remains unchanged, meaning the payload runs with the privileges of the user launching the client.

Root Cause

The defect is classified as [CWE-122]: heap-based buffer overflow. The client allocates a heap buffer sized against a value derived from untrusted server input, then copies additional server-controlled data into that buffer without validating that the total length fits. The resulting out-of-bounds write corrupts adjacent heap structures used later by the client, enabling control-flow hijack.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a malicious RDP server and lures a target into connecting via phishing, a crafted .rdp file, a malicious hyperlink, or connection redirection. Once the client negotiates the session, the server delivers the malformed message that triggers the overflow. No prior authentication to the victim system is required. Full technical details are maintained in the Microsoft Security Update Guide.

Detection Methods for CVE-2026-80077

Indicators of Compromise

Unexpected outbound RDP connections (TCP/UDP 3389) from user workstations to untrusted external IP addresses or domains.
Crashes or abnormal termination of mstsc.exe or related Remote Desktop Client processes shortly after connection initiation.
Delivery of .rdp file attachments from external senders, particularly with embedded non-standard server addresses.
Child processes spawned by the Remote Desktop Client that are inconsistent with normal user activity (for example, shells, scripting engines, or LOLBins).

Detection Strategies

Monitor process telemetry for mstsc.exe spawning cmd.exe, powershell.exe, rundll32.exe, or writing executables to disk.
Alert on RDP client processes making outbound connections to IP addresses outside approved corporate ranges.
Inspect email and web gateways for .rdp file attachments and downloads, and quarantine those from untrusted origins.
Correlate client-side crashes (Windows Error Reporting events) with immediately preceding outbound RDP sessions.

Monitoring Recommendations

Enable and forward Sysmon Event IDs 1 (process creation), 3 (network connection), and 11 (file create) for endpoints running the Remote Desktop Client.
Baseline expected RDP client destinations and alert on deviations, especially connections to internet-routable addresses.
Track EPSS trending for CVE-2026-80077 to detect increased exploitation likelihood over time.

How to Mitigate CVE-2026-80077

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected endpoints.
Prioritize patching for systems used by administrators, developers, and any users who routinely initiate outbound RDP sessions.
Block .rdp file attachments at the email gateway and warn users against opening RDP connection files from untrusted sources.

Patch Information

Microsoft has issued a fix through the Microsoft Security Update Guide. Administrators should deploy the vendor-supplied update via Windows Update, WSUS, Microsoft Intune, or their standard patch management tooling. Verify the update installed successfully by validating build numbers against the vendor advisory.

Workarounds

Restrict outbound TCP and UDP port 3389 at the perimeter firewall to approved destinations only, preventing users from connecting to arbitrary internet-based RDP servers.
Apply Group Policy to disable execution of .rdp files delivered from untrusted zones and enforce warnings on unsigned RDP configuration files.
Enforce least privilege on end-user accounts so that a compromised client process runs without administrative rights.
Deliver targeted user awareness training on the risk of connecting to untrusted Remote Desktop endpoints.

bash

# Example: block outbound RDP to non-approved destinations via Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound RDP to Untrusted" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 3389 `
  -RemoteAddress Internet `
  -Action Block