CVE-2026-58594 — Remote Desktop Client Remote Code Execution Vulnerability

Executive Summary

Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.

Overview

9.8

CVSS CRITICAL

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Remote Code Execution

Weakness CWE-190: Integer Overflow or Wraparound

Released Jul 14 2026

Last Updated Jul 14 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00767 — 0.52388 percentile

NVD CVSS 9.8 CRITICAL — differs from MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

ATTACK VECTOR

Network

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

None

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 7.7

EPSS Score

0.00767

probability of exploitation in the next 30 days

0.52388 percentile - updated 2026-08-14

View on FIRST.org

Affected Products

27 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5099535 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1607 for x64-based Systems	`5099535 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1809 for 32-bit Systems	`5099538 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1809 for x64-based Systems	`5099538 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for x64-based Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for x64-based Systems	`5099539 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 24H2 for ARM64-based Systems	`5101650 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 24H2 for x64-based Systems	`5101650 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 25H2 for ARM64-based Systems	`5101650 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 25H2 for x64-based Systems	`5101650 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 26H1 for ARM64-based Systems	`5101649 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 version 26H1 for x64-based Systems	`5101649 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2012	`5099445 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 (Server Core installation)	`5099445 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 R2	`5099444 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 R2 (Server Core installation)	`5099444 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2016	`5099535 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2016 (Server Core installation)	`5099535 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2019	`5099538 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2019 (Server Core installation)	`5099538 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2022	`5099540 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2025	`5099536 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2025 (Server Core installation)	`5099536 (Security Update)`	Important	Remote Code Execution	Yes

Patches

9 patches

Article	Type	Restart
`5099535`	Security Update	Yes
`5099538`	Security Update	Yes
`5099539`	Security Update	Yes
`5101650`	Security Update	Yes
`5101649`	Security Update	Yes
`5099445`	Monthly Rollup	Yes
`5099444`	Monthly Rollup	Yes
`5099540`	Security Update	Yes
`5099536`	Security Update	Yes

Patch Diff

ghidriff · mstscax.dll (KB5101650)

Integer overflow (CWE-190) leading to a heap buffer overflow in the Remote Desktop Client mstscax.dll frame-buffer allocation, remote code execution on a client that connects to a malicious RDP server (Important, RCE, AV:N, UI:R, CVSS 8.8). When decoding server-supplied graphics, CacNx::SurfaceDecoderCpu::Init allocates a CPU frame/surface buffer sized from the server-advertised surface width x height x 4. PRE: the size was computed as 4 * width * height in 32-bit arithmetic, so a malicious server advertising dimensions whose product overflows 32 bits makes malloc receive a wrapped, undersized size while the client later writes a full-size surface into it - a heap overflow. Because the client parses attacker-controlled server data over the network (UI:R: the user connects to the server), the overflow is an RCE primitive on the client. Diff of mstscax.dll 10.0.26100.8737 -> .8875 (Jul 14 2026, KB5101650, 24H2) confirms the fix: gated behind CFR flag Feature_2141685050, SurfaceDecoderCpu::Init computes _Size = (longlong)height * (longlong)width * 4 (64-bit product) and rejects a zero/overflowed size (WPP log 'Frame buffer allocation size overflow or zero', return E_INVALIDARG 0x80070057) before free/malloc. A separate lower-bound guard on decoder dimensions was added in CaCpuDecompressor in the same update. Cross-checked against an independent writeup (vulnerable expression, diagnostic string, and 64-bit-product fix match; the writeup cites Feature_2208793915 while the ghidriff shows Feature_2141685050).

Pre-patch version 10.0.26100.8737 Download

Post-patch version 10.0.26100.8875 Download

Function	Address	Change	Note
`CacNx::SurfaceDecoderCpu::Init`	`code change`	code (frame-buffer size now 64-bit with zero/overflow reject, CFR-gated)	Pre: malloc(4 * width * height) computed in 32-bit -> a server-chosen dimension product overflows and undersizes the buffer. Post (Feature_2141685050): _Size = (longlong)(int)(param_2+4) * (longlong)(int)param_2 * 4 (64-bit); if (_Size == 0) log 'Frame buffer allocation size overflow or zero' and return E_INVALIDARG; then free(this+0xe0) and malloc(_Size).
`CaCpuDecompressor (related guard)`	`code change`	code (lower-bound guard on decoder dimensions, same update)	A separate lower-bound dimension check was added in CaCpuDecompressor; it is a distinct guard from the frame-buffer size overflow fix and is not the same validation path.
`Feature_2141685050`	`gate`	added (CFR gate)	CFR flag gating the 64-bit frame-buffer size computation and zero/overflow check in SurfaceDecoderCpu::Init; the original 32-bit multiply ships when disabled. (An independent writeup cites Feature_2208793915 for the same fix.)

View full diff report View RCA report

Attack Path

A malicious RDP server advertises surface dimensions whose 32-bit size product overflows, undersizing the client frame buffer

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

Sanil Singh Tomar with Microsoft

References

MSRC Advisory MITRE NVD