Windows Remote Desktop Client Heap Overflow — Network RCE (CVE-2025-29966)
A heap-based buffer overflow in the Windows Remote Desktop client allows an attacker who controls an RDP server to execute code on any Windows host that connects out to it. CVSS 8.8 — requires the victim to initiate an RDP session to the attacker. Patched in the May 13 2025 cumulative.
An attacker who controls an RDP server (or who can man-in-the-middle an RDP connection) can execute code on the connecting host. Realistic attack paths include malicious .rdp shortcuts dropped on a file share, phishing emails with .rdp attachments, and lateral-movement scenarios where a previously-compromised jump box hosts a tampered RDP listener.
CVE-2025-29966 is a heap-based buffer overflow in how the Windows Remote Desktop client parses server-sent data during an RDP session. A malicious RDP server can send crafted protocol responses that overflow a client-side heap buffer, leading to code execution in the client process on the host that initiated the outbound RDP connection.
Probably yes if any of these apply:
Affected OS versions
Microsoft did not flag CVE-2025-29966 as exploited in the wild at the May 13 2025 release. However, NVD assigns CVSS 8.8 and Microsoft rated this as critical-severity precisely because the network-attack-vector + no-attacker-auth + low-complexity combination matches historical CVEs that were weaponised within weeks of disclosure (the 2024 CVE-2024-21320 RDP client RCE is the precedent).
Manual remediation steps
⏱ 30–60 minutes including rebootIdentify Affected Hosts
All Windows hosts that can initiate outbound RDP — i.e. anywhere mstsc.exe might run — are affected until patched.
Get-ComputerInfo | Select-Object WindowsVersion, OsBuildNumber
Apply the Fix
Install the May 2025 Patch Tuesday cumulative update.
USoClient.exe ScanInstallWait
# Or manual install (per OS):
wusa.exe <kb-msu-file> /quiet /norestart
shutdown.exe /r /t 600 /c "May 2025 security update — reboot in 10 minutes"
Compensating Controls (until patched)
User Configuration > Administrative Templates > Windows Components >
Remote Desktop Services > Remote Desktop Connection Client >
"Do not allow passwords to be saved" (and similar hardening).
Verify
Get-ComputerInfo | Select-Object OsBuildNumber
# Must be at or above the May 13 2025 build for the SKU
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References