CVE-2026-80096 Overview
CVE-2026-80096 is an out-of-bounds read vulnerability [CWE-125] in Windows Remote Desktop Services (RDS). An authorized attacker on the network can trigger the flaw to elevate privileges on the target system. The vulnerability affects nearly every supported Windows client and server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Microsoft published the advisory on 2026-09-08 and updated it on 2026-09-10.
Critical Impact
An authenticated network attacker can read memory outside allocated buffers in RDS and leverage the exposure to elevate privileges, potentially impacting confidentiality, integrity, and availability across a broad Windows install base.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-09-08 - CVE-2026-80096 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-80096
Vulnerability Analysis
The flaw resides in Windows Remote Desktop Services, the component that handles Remote Desktop Protocol (RDP) sessions and Terminal Services connections. RDS parses a large volume of client-supplied structures during session establishment and channel negotiation. When a bounds check is missing or incorrect, the service reads past the end of an allocated buffer.
The out-of-bounds read exposes adjacent process memory to the attacker. That memory can include session tokens, credential material, pointers, or other state that supports a follow-on privilege escalation primitive. The attacker gains elevated rights on the RDS host after leveraging the disclosed data.
The issue requires an authenticated attacker with low privileges, which matches configurations where standard users hold RDP access to shared session hosts, jump boxes, or virtual desktop infrastructure (VDI) environments.
Root Cause
The root cause is an out-of-bounds read [CWE-125] in RDS message or structure handling. The affected code path dereferences a length or offset derived from attacker-controlled input without validating that the resulting read stays within the allocated object. Microsoft has not published a code-level breakdown; consult the Microsoft Security Update Guide for CVE-2026-80096 for the authoritative technical description.
Attack Vector
Exploitation occurs over the network against an RDS endpoint, typically TCP 3389. The attacker authenticates with valid credentials, opens a session, and sends crafted RDP traffic that triggers the vulnerable parser. Successful exploitation yields privilege escalation on the host running Remote Desktop Services, which is often a multi-user session host.
No public proof-of-concept exploit is currently listed, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-80096
Indicators of Compromise
- Unexpected svchost.exe or TermService process crashes, hangs, or WER (Windows Error Reporting) entries on RDS hosts
- Newly created privileged local accounts or group membership changes shortly after RDP authentication events
- RDP sessions from low-privilege accounts followed by process launches under SYSTEM or high-integrity contexts
Detection Strategies
- Correlate Windows Event ID 4624 (logon) type 10 (RemoteInteractive) with subsequent Event ID 4672 (special privileges assigned) for the same session ID
- Alert on child processes of TermService or session broker components that spawn cmd.exe, powershell.exe, or LOLBins
- Baseline expected RDP client versions and flag anomalous RDP channel negotiation patterns at the network layer
Monitoring Recommendations
- Forward Security, System, and TerminalServices operational logs to a centralized analytics platform for cross-host correlation
- Monitor for repeated authenticated connections from the same source that trigger RDS service faults
- Track privileged group modifications on session hosts and VDI brokers in near real time
How to Mitigate CVE-2026-80096
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-80096 on all affected Windows client and server builds
- Prioritize patching internet-exposed RDP hosts, session hosts, jump boxes, and VDI infrastructure
- Audit which accounts hold RDP access rights and remove unnecessary standing privileges
Patch Information
Microsoft addressed CVE-2026-80096 through cumulative updates for each affected Windows version. Consult the Microsoft Security Update Guide for CVE-2026-80096 for the specific KB article and build numbers that map to your operating system. Deploy the updates through Windows Update, WSUS, Intune, or Configuration Manager per your standard patch process.
Workarounds
- Restrict inbound TCP 3389 at the network perimeter and expose RDS only through a Remote Desktop Gateway with MFA
- Enforce Network Level Authentication (NLA) to require successful authentication before session negotiation
- Limit Remote Desktop Users group membership to a minimal, monitored set of accounts until patches are deployed
# Example: enforce NLA and restrict RDP to gateway-only access
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1
New-NetFirewallRule -DisplayName 'Block Direct RDP' -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block -RemoteAddress Any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
