High

Remote Desktop Client Heap-Based Buffer Overflow RCE

IdentifiersCVE-2025-29967CWE-122· Heap-based Buffer Overflow

CVE-2025-29967 is a critical heap-based buffer overflow in Microsoft Remote Desktop Client. Multiple supporting sources in the provided content consistently describe it as a Remote Desktop Client remote code execution vulnerability with CVSS 8.8. Exploitation occurs when a vulnerable Remote Desktop Client connects to an attacker-controlled or malicious RDP server, which can trigger the heap overflow during session establishment/start. The flaw is memory-corruption based and can allow arbitrary code execution on the client system.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in arbitrary code execution on the vulnerable client machine. Because the attack is triggered by a malicious RDP server during connection setup, it can provide an attacker with immediate remote compromise of the client endpoint in the security context of the affected process/user, potentially enabling further privilege escalation, lateral movement, persistence, or malware deployment.

Mitigation

If you can’t patch tonight, do this now.

Until patches are fully deployed, restrict or prohibit RDP connections from vulnerable clients to untrusted, unknown, or internet-hosted RDP servers. Limit outbound RDP usage to approved destinations, enforce network segmentation and allowlisting for administrative RDP workflows, and monitor for unusual RDP connection activity that may indicate attempted exploitation. If operationally feasible, disable or avoid use of the affected Remote Desktop Client functionality when connecting to untrusted systems.

Remediation

Patch, then assume compromise.

Apply Microsoft's May 2025 security updates that address CVE-2025-29967. Prioritize patching all systems with vulnerable Remote Desktop Client components, especially endpoints used to initiate RDP sessions to untrusted or external hosts. Use standard enterprise deployment mechanisms such as Windows Update, WSUS, or Intune as appropriate.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationRemote Desktopapplication

Microsoft CorporationWindows 10 1507operating_system

Microsoft CorporationWindows 10 1607operating_system

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 21h2operating_system

Microsoft CorporationWindows 10 22h2operating_system

Microsoft CorporationWindows 11 22h2operating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows 11 24h2operating_system

Microsoft CorporationWindows App Client For Windows Desktopapplication

Microsoft CorporationWindows Server 2008operating_system

Microsoft CorporationWindows Server 2008 R2operating_system

Microsoft CorporationWindows Server 2012operating_system

Microsoft CorporationWindows Server 2012 R2operating_system

Microsoft CorporationWindows Server 2016operating_system

Microsoft CorporationWindows Server 2019operating_system

Microsoft CorporationWindows Server 2022operating_system

Microsoft CorporationWindows Server 2022 23h2operating_system

Microsoft CorporationWindows Server 2025operating_system

Microsoft CorporationWindows Server 23h2operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

Microsoft primes 71 fixes for May Patch Tuesday | SOPHOS

A critical remote code execution vulnerability in Windows Remote Desktop Services.

zeropath blogNews

Jul 8, 2025

Windows RRAS Under Siege: Unpacking CVE-2025-48824's Heap-Based Buffer Overflow - ZeroPath Blog | ZeroPath

A past Microsoft vulnerability referenced only as part of vendor security history; no specific technical details are provided in the content.

May 14, 2025

Apple patched one first, but Microsoft’s blasted five exploited flaws this Pa-Tu

Remote Desktop Client remote code execution vulnerability.

cyberthroneNews

May 14, 2025

Microsoft Patch Tuesday May 2025

A remote code execution vulnerability in Remote Desktop Client & Gateway Service, allowing arbitrary code execution on client and server systems.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2025-29967

NVD

nvd.nist.gov/vuln/detail/CVE-2025-29967

MITRE CWE · CWE-122

Heap-based Buffer Overflow

Vendor Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29967