CVE-2026-50330

What it actually does

This vulnerability is a heap-based buffer overflow in the Microsoft Remote Desktop Client affecting multiple supported Windows client and server versions. A remote, unauthenticated attacker can send specially crafted Remote Desktop Protocol traffic that causes memory corruption in the client-side RDP component. Based on the supplied CVSS vector, the confirmed impact is high availability impact: the vulnerable component or process may crash or become unstable. The description references elevation of privilege, so organizations should treat the flaw as potentially security-sensitive beyond denial of service until vendor guidance or patches clarify the exact exploit outcome.

Why it matters to the business

Successful exploitation could disrupt Remote Desktop access, crash affected client components, and interfere with administrative or operational workflows that depend on RDP. Because Remote Desktop is commonly used for server administration and remote support, outages or instability can have a broad operational impact across Windows estates. The vulnerability is network-reachable, requires no authentication, and has low attack complexity, but it is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS, so remediation should be prioritized but can be managed through normal emergency patch governance unless exposure is high.

How an attack unfolds

An attacker positions a malicious or compromised RDP endpoint, or otherwise delivers crafted RDP traffic to a vulnerable Remote Desktop Client. The vulnerable client parses attacker-controlled protocol data and mishandles heap memory, resulting in a buffer overflow. The immediate observable outcome is likely a crash of mstsc.exe, msrdc.exe, or related Remote Desktop client components, Windows Error Reporting events, and interrupted RDP sessions. If exploit development advances beyond crashing to controlled memory corruption, the risk could include execution in the context of the affected client process or privilege-related effects described by the vendor; however, no mature public exploitation is indicated in the supplied data.

How to fix it

Apply the Microsoft security update for the affected Windows versions through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the organization’s standard patch deployment platform. Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so administrators should validate against Microsoft’s official advisory and ensure the latest cumulative update applicable to each OS version is installed. As mitigations, restrict outbound and inbound RDP access to trusted hosts, avoid connecting from privileged workstations to untrusted RDP servers, use VPN or remote access gateways, enforce network segmentation, and monitor or block unexpected TCP/3389 traffic where operationally feasible.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative update that includes the fix for this Remote Desktop Client vulnerability. Validate using Windows Update history, Microsoft Update compliance reporting, WSUS/Configuration Manager/Intune patch status, or PowerShell inventory of installed hotfixes and OS build numbers. Test that Remote Desktop Client functionality still works after patching, especially on administrative workstations and jump hosts. To confirm exposure reduction, verify that systems no longer run unpatched affected builds and that RDP access is limited to expected destinations and management paths. Review endpoint crash telemetry to ensure mstsc.exe, msrdc.exe, and mstscax.dll crash events decline after deployment.

Typical attack path

1. Identify Windows systems using affected Remote Desktop Client versions.
2. Expose or lure a vulnerable client into processing attacker-controlled RDP traffic, such as by connecting to a malicious or compromised RDP service.
3. Send malformed RDP protocol data that triggers the heap-based buffer overflow in the Remote Desktop Client component.
4. Cause memory corruption, typically resulting in a crash or denial of service of the Remote Desktop client process.
5. Optionally repeat the attack to disrupt remote administration or attempt further exploit development if reliable control of memory corruption is achieved.

How to detect it

To determine whether exploitation may already have occurred, review endpoint and centralized Windows logs for Remote Desktop client crashes, heap corruption, and access violation events around the time of RDP connections. Key sources include Windows Application logs, Windows Error Reporting events, Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational, Microsoft-Windows-TerminalServices-RDPClient/Operational where present, EDR process telemetry, crash dump repositories, and network logs for TCP/3389 connections. Look for repeated crashes of mstsc.exe, msrdc.exe, or components such as mstscax.dll, especially when correlated with connections to unfamiliar RDP servers. Investigate Windows Error Reporting Event IDs 1000 and 1001, Application Error records, APPCRASH/BEX reports, exception codes associated with heap corruption or memory access violations, and any crash dumps generated immediately after an RDP session was initiated. Because no public exploit indicators or threat actor-specific artifacts are supplied, detection should focus on behavioral evidence: abnormal RDP client instability, repeated failures triggered by the same remote host, unusual RDP destinations, and post-crash activity by the same user session or process lineage.

• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Faulting module name: mstscax.dll
• Exception code: 0xc0000374
• Exception code: 0xc0000005
• APPCRASH_mstsc.exe
• APPCRASH_msrdc.exe
• BEX64_mstsc.exe
• BEX64_msrdc.exe
• Remote Desktop Connection has stopped working
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• \Windows\System32\mstsc.exe
• \Windows\SysWOW64\mstsc.exe
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• TCP/3389

What your security team should do

• Prioritize patching systems that initiate or broker RDP sessions, including administrator workstations, jump servers, helpdesk machines, VDI images, and servers used for remote administration.
• Deploy the latest applicable Microsoft cumulative update across all affected Windows 10, Windows 11, and Windows Server versions.
• Restrict RDP connectivity to trusted networks and approved hosts; block unnecessary TCP/3389 access at firewalls and host controls.
• Discourage administrators from using privileged accounts to connect to untrusted or unmanaged RDP endpoints.
• Enable and review Windows Error Reporting, Application, and Remote Desktop client logs for abnormal mstsc.exe or msrdc.exe crashes.
• Monitor for repeated RDP client crashes correlated with connections to the same remote IP address or hostname.
• Treat recurring heap corruption or access violation crashes in Remote Desktop components as suspicious, even without known public exploit maturity.
• Maintain elevated urgency for internet-facing or high-use RDP environments despite the current low EPSS and absence from CISA KEV.