TI-2020-12867 Aliases CVE-2020-16863 GHSA-69gr-hfqx-6mvx

Windows Remote Desktop Service Denial of Service Vulnerability

MEDIUM 48Published 2020-10-16 · Updated 2024-10-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A denial of service vulnerability exists in Windows Remote Desktop Service when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the Remote Desktop Service on the target system to stop responding. To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides Remote Desktop Service. The update addresses the vulnerability by correcting how Remote Desktop Service handles connection requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.05847 93rd percentileScored 2026-11-07

Fix Fixed Windows 7 (Microsoft): publicationWindows 7 Service Pack 1 (Microsoft): publication+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Windows 7	6.1.0 to before publication	publication	Patch available	CNA
Microsoft	Windows 7 Service Pack 1	6.1.0 to before publication	publication	Patch available	CNA
Microsoft	Windows Server 2008 R2 Service Pack 1	6.1.0 to before publication	publication	Patch available	CNA
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	6.0.0 to before publication	publication	Patch available	CNA

Windows 7 VendorMicrosoft Affected 6.1.0 to before publication Fixed in publication Patch available CNA
Windows 7 Service Pack 1 VendorMicrosoft Affected 6.1.0 to before publication Fixed in publication Patch available CNA
Windows Server 2008 R2 Service Pack 1 VendorMicrosoft Affected 6.1.0 to before publication Fixed in publication Patch available CNA
Windows Server 2008 R2 Service Pack 1 (Server Core installation) VendorMicrosoft Affected 6.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:microsoft:windows_7:-:sp1::::::	not specified by NVD	Vulnerable	Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*	r2 sp1	Vulnerable	Microsoft

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Vulnerable ·Microsoft

Remediation

Fix · CNA Windows 7 (Microsoft) Fixed in publication
Fix · CNA Windows 7 Service Pack 1 (Microsoft) Fixed in publication
Fix · CNA Windows Server 2008 R2 Service Pack 1 (Microsoft) Fixed in publication
Fix · CNA Windows Server 2008 R2 Service Pack 1 (Server Core installation) (Microsoft) Fixed in publication

Timeline

2026-10-02 Threatist record created from CVE-2020-16863
2026-10-03 Alias added: GHSA-69gr-hfqx-6mvx

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16863

TI-2019-00485 Use after free in Microsoft Windows KEVCVSS 3.1CRITICAL 9.8
TI-2017-06077 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista… KEVCVSS 3.1CRITICAL 9.8
TI-2015-01465 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1… KEVCVSS 3.1CRITICAL 9.8
TI-2022-19649 Windows Scripting Languages Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2021-17496 Microsoft MSHTML Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2021-13480 Scripting Engine Memory Corruption Vulnerability KEVCVSS 3.1HIGH 8.8

See all 2366 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences