CVE-2026-54990
A critical heap-based buffer overflow exists in the Remote Desktop Client on certain Windows 11 and Windows Server 2025 builds. An attacker who can reach the vulnerable system over a network can run arbitrary code without authentication. The flaw is severe because it allows full control of the target machine.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Windows 11 24H2, 25H2, 26H1 and Windows Server 2025 (all builds listed).
Real-world impact
An attacker could run any code they choose on the affected machine, potentially taking full control, stealing data, or using the system as part of a larger attack.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network, requires no user interaction, and gives the attacker complete confidentiality, integrity, and availability compromise. The low attack complexity and lack of required privileges make it highly dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…patchvendor advisory