CVE-2026-84012: Remote Desktop Gateway Service RCE Flaw

CVE-2026-84012 Overview

CVE-2026-84012 is a double free vulnerability [CWE-415] in the Microsoft Remote Desktop Gateway (RD Gateway) Service. The flaw allows an unauthenticated attacker to execute arbitrary code over the network by triggering memory corruption in the service. Exploitation requires no user interaction and no prior credentials, though attack complexity is high due to timing or state conditions needed to win the free/reuse race. Successful exploitation yields code execution in the context of the RD Gateway Service, which typically brokers inbound Remote Desktop Protocol (RDP) traffic from the public internet.

Critical Impact

Unauthenticated remote attackers can execute code on internet-facing RD Gateway servers, compromising the perimeter that fronts internal RDP infrastructure.

Affected Products

• Microsoft Windows Server with the Remote Desktop Gateway role enabled
• Microsoft Remote Desktop Services (RDS) deployments exposing the RD Gateway endpoint
• Refer to the Microsoft Security Update Guide for CVE-2026-84012 for the authoritative list of affected builds

Discovery Timeline

• 2026-10-13 - CVE-2026-84012 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84012

Vulnerability Analysis

The vulnerability resides in the Remote Desktop Gateway Service, which tunnels RDP sessions over HTTPS on TCP/443 for remote clients. A double free condition occurs when the service releases the same heap allocation twice during request processing. The second free corrupts heap metadata and allocator freelists, enabling an attacker who controls subsequent allocations to influence memory layout. By shaping the heap and placing attacker-controlled data at the reclaimed address, the attacker can hijack control flow and execute code in the gateway process.

Because RD Gateway accepts connections prior to authentication, the vulnerable code path is reachable without credentials. The service typically runs with high privileges on the host, so successful exploitation grants a foothold at the network perimeter. From that position, attackers can pivot to internal RDP targets, harvest session state, or stage further intrusion activity.

Root Cause

The root cause is improper memory lifecycle management [CWE-415]. A code path releases a heap object and a second code path, operating on a stale reference, releases the same object again. The condition likely depends on specific request sequencing or concurrent handling, which accounts for the high attack complexity rating.

Attack Vector

Exploitation is network-based. An attacker sends crafted traffic to the RD Gateway HTTPS endpoint to trigger the duplicate deallocation and then grooms the heap through additional requests to control the reclaimed memory. No authentication, user interaction, or local access is required. Public technical details and proof-of-concept code are not available at the time of publication.

See the Microsoft Security Update Guide for vendor-supplied technical context.

Detection Methods for CVE-2026-84012

Indicators of Compromise

• Unexpected crashes, access violations, or restart events for the TSGateway service or associated worker processes
• Anomalous HTTPS request patterns to the RD Gateway endpoint from untrusted or geographically unusual sources
• New child processes spawned by RD Gateway service binaries, especially cmd.exe, powershell.exe, or script hosts
• Outbound connections initiated by RD Gateway processes to non-RDP destinations

Detection Strategies

• Monitor Windows Event Log for Application Error (Event ID 1000) and Windows Error Reporting events referencing RD Gateway binaries
• Alert on process creation events where the parent is an RD Gateway service process and the child is a shell or interpreter
• Inspect RD Gateway operational logs for malformed tunnel creation requests or abnormal session termination patterns

Monitoring Recommendations

• Baseline normal RD Gateway client populations and alert on spikes from unrecognized Autonomous Systems or regions
• Forward RD Gateway and Windows security logs to a centralized SIEM for correlation with endpoint telemetry
• Enable crash dump collection on gateway hosts to support forensic triage of suspected exploitation attempts

How to Mitigate CVE-2026-84012

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-84012 on all Windows Servers running the RD Gateway role
• Inventory all internet-facing RD Gateway instances and prioritize patching those exposed to untrusted networks
• Review RD Gateway access logs for signs of exploitation attempts prior to patch deployment

Patch Information

Microsoft has issued updates addressing CVE-2026-84012 through the Microsoft Update Guide. Administrators should consult the vendor advisory for the specific KB articles and cumulative updates that correspond to each supported Windows Server release.

Workarounds

• Restrict inbound TCP/443 access to the RD Gateway endpoint using firewall ACLs that permit only known client IP ranges
• Place the RD Gateway behind a reverse proxy or VPN that enforces authentication before traffic reaches the vulnerable service
• Temporarily disable the RD Gateway role on hosts where remote access can be delivered through alternative means until patching is complete

# Example: restrict inbound HTTPS to RD Gateway using Windows Firewall
New-NetFirewallRule -DisplayName "RDGW-Allow-TrustedClients" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 203.0.113.0/24,198.51.100.0/24 -Action Allow

New-NetFirewallRule -DisplayName "RDGW-Block-Default" `
  -Direction Inbound -Protocol TCP -LocalPort 443 -Action Block