Description
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Published: 2026-06-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use-after‑free flaw in the Remote Desktop Client allows an unauthorized attacker to execute code over a network. The vulnerability can lead to remote code execution on the affected Windows Server systems. This weakness is categorized as CWE-416 and CWE-787, involving memory corruption that can be exploited to run arbitrary code.

Affected Systems

Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, and Microsoft Windows Server 2025 (Server Core installation) are affected. Specific affected versions are not listed in the CVE payload, so administrators should review Microsoft documentation for details.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is does not require valid credentials; any remote host that can initiate an RDP connection to the affected server could trigger the flaw.

Generated by OpenCVE AI on July 17, 2026 at 15:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Microsoft patch, which can be downloaded from the MSRC update guide for CVE-2026-47654
  • If Remote Desktop is not required, disable the RDP service to remove the attack surface
  • Limit RDP access to trusted IP addresses and enforce that only authorized administrators can initiate a Remote Desktop session

Generated by OpenCVE AI on July 17, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
Description Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Fri, 12 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*

Wed, 10 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 10 Jun 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)

Tue, 09 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Description Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Title Remote Desktop Client Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-416
CPEs cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C'}

Subscriptions

Microsoft Windows Server 2016 Windows Server 2016 (server Core Installation) Windows Server 2019 Windows Server 2019 (server Core Installation) Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-07-15T20:09:33.606Z

Reserved: 2026-05-19T20:12:27.071Z

Link: CVE-2026-47654

cve-icon Vulnrichment

Updated: 2026-06-10T10:24:05.367Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T17:17:36.933

Modified: 2026-06-12T17:27:29.240

Link: CVE-2026-47654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T15:45:05Z

Weaknesses