Microsoft’s May 2025 Patch Tuesday addressed two critical Windows RDP Buffer Overflow vulnerabilities, identified as CVE-2025-29966 and CVE-2025-29967. Both enable remote code execution over the network through heap memory corruption.
- CVE-2025-29966 affects the Remote Desktop Client. If a user connects to a malicious RDP server, the attacker can exploit this flaw to execute arbitrary code on the client system.
- CVE-2025-29967 affects the Remote Desktop Gateway Service, exposing systems to similar RCE risks when improperly secured endpoints interact with crafted requests.
Both flaws are classified under CWE-122: Heap-based Buffer Overflow.
Affected Components
- Remote Desktop Client (CVE-2025-29966)
- Remote Desktop Gateway (CVE-2025-29967)
The vulnerabilities exist across multiple Windows OS versions that support RDP, including client and server installations.
Exploitation Details
An attacker must control the RDP server (for CVE-2025-29966) or reach an exposed Gateway endpoint (for CVE-2025-29967). The flaw allows crafted payloads to corrupt heap memory structures, resulting in arbitrary code execution on the target system.
No authentication is required for exploitation in some attack paths. Microsoft rates the vulnerabilities as Critical with high CVSS scores, although they are currently assessed as Exploitation Less Likely.
Patch and Mitigation
Microsoft has released patches via:
- Windows Update
- Windows Server Update Services (WSUS)
- Microsoft Update Catalog
There are no workarounds. Patching is the only mitigation.
Recommendations
- Apply May 2025 security updates immediately
- Restrict RDP access to trusted endpoints
- Implement network segmentation and RDP gateway hardening
- Monitor connections for anomalies in RDP usage
Additional Context
These vulnerabilities were part of a larger May 2025 update batch, which addressed 72 total flaws, including 5 actively exploited zero-days. The RDP-related CVEs, though not yet observed in the wild, represent a high-risk surface due to their ability to compromise systems without user interaction in certain scenarios.