CVE-2026

Api.Msrc.Microsoft • September 8, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Jul 14, 2026

Last updated: Sep 8, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

How could an attacker exploit this vulnerability?

An attacker could exploit this vulnerability by persuading a user to connect to a malicious Remote Desktop Protocol (RDP) server using a vulnerable RDP client. The malicious server could send specially crafted responses that trigger memory corruption on the client system, potentially allowing arbitrary code execution in the context of the logged-on user. Successful exploitation requires user interaction to establish the RDP connection.

Thanatos Tian & PB18 & @2st__ with Diffract

Kyeongmin Kim (@hareh4ru) with KAIST Hacking Lab

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Acknowledgement Updated

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed for Microsoft Products On September 8, 2026, Microsoft published advisories for three critical vulnerabilities affecting its products. CVE-2026-54990 is a heap-based buffer overflow in the Remote Desktop Client, allowing unauthorized code execution via a malicious RDP server. CVE-2026-42914 is an out-of-bounds read in Windows Kerberos, enabling authorized attackers to cause denial of service under specific conditions. CVE-2026-44814 involves an out-of-bounds read in the Windows DWM Core Library, which could lead to local information disclosure. The vulnerabilities were released between June and July 2026, with the latest updates provided on September 8, 2026. Successful exploitation of these vulnerabilities requires user interaction or specific configurations. Microsoft has acknowledged these vulnerabilities and provided guidance for mitigation. 4 sources 57

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)