# RDP Gateway pre-auth RCE via UDP fragment reassembly flaws (CVE-2020-0609, CVE-2020-0610)

> Two separate pre-authentication remote code execution bugs in the Windows Remote Desktop Gateway (RD Gateway) UDP transport (default UDP/3391). CVE-2020-0609 is a bounds-checking failure in fragment reassembly that allows writes of up to 999 bytes at attacker-controlled heap offsets; CVE-2020-0610 is an out-of-bounds array write when tracking received fragments. Microsoft patched both in the January 2020 security update; public DoS PoC and scanner code (BlueGate, RDGScanner) followed within two weeks.

- **Published:** 2026-10-17T17:56:47Z
- **Last reviewed:** 2026-10-17T17:56:47Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3828
- **ID:** TL-2026-3828
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-0609, CVE-2020-0610

## Description

Windows Remote Desktop Gateway (Terminal Services Gateway) brokers RDP connections over HTTP, HTTPS and a UDP transport. Kryptos Logic analyzed the UDP handler and found two distinct memory-corruption flaws reachable before authentication and with no user interaction. The RDG-UDP protocol splits large messages across multiple UDP packets that may arrive out of order; each packet carries a fragment_id (position), num_fragments (total) and fragment_length. The reassembly logic fails to properly validate these attacker-supplied values.

CVE-2020-0609 (heap out-of-bounds write): the reassembly buffer is allocated at 1000 bytes and each fragment is copied with memcpy_s to an offset computed as fragment_id x 1000, but the bounds check ignores that offset. An attacker can therefore write 999 bytes to any offset from 1 up to roughly 65,534,000 bytes beyond the end of the buffer. This is a precise, controlled write primitive rather than a linear overflow.

CVE-2020-0610 (out-of-bounds array write): the array that records which fragments have been received has only 64 entries, yet fragment_id may range from 0 to 65535. Any fragment_id between 65 and 65535 writes a 1 (TRUE) outside the array bounds, giving a single-byte out-of-bounds write that can alter program behavior.

Exploitation status: neither the Kryptos Logic post nor NVD states in-the-wild exploitation, and no threat actor attribution is reported. On 2020-01-26 a researcher using the pseudonym Ollypwn published BlueGate on GitHub, a PoC that can cause denial of service and includes a vulnerability check mode; Marcus Hutchins (MalwareTech) published RDGScanner, which detects vulnerable servers by sending a CONNECT_PKT_FRAGMENT message with num_fragments above 64 (patched hosts disconnect with error 0x8000ffff, vulnerable hosts allow the connection). Qualys reported that a researcher had developed a working RCE exploit that had not been publicly released, and that over 15,000 vulnerable RD Gateway servers were reachable online at the time of reporting. Exposure requires inbound TCP/443 plus UDP/3391 to the gateway. Mitigations from the source: install the January 2020 update, or disable UDP transport in the RD Gateway settings / firewall UDP/3391.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1499.004 Application or System Exploitation

## Sources

- [RDP to RCE: When Fragmentation Goes Wrong](https://www.kryptoslogic.com/blog/2020/01/rdp-to-rce-when-fragmentation-goes-wrong/)
- [NVD - CVE-2020-0609](https://nvd.nist.gov/vuln/detail/CVE-2020-0609)
- [NVD - CVE-2020-0610](https://nvd.nist.gov/vuln/detail/CVE-2020-0610)
- [Microsoft MSRC - CVE-2020-0609](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0609)
- [Microsoft MSRC - CVE-2020-0610](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0610)
- [Qualys ThreatPROTECT - Microsoft Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerabilities](https://threatprotect.qualys.com/2020/01/27/microsoft-windows-remote-desktop-gateway-rd-gateway-remote-code-execution-vulnerabilities/)
- [BlueGate PoC (ollypwn) - DoS and check mode for CVE-2020-0609/0610](https://github.com/ollypwn/BlueGate)
- [RDGScanner (MalwareTech) - scanner for CVE-2020-0609/0610](https://github.com/MalwareTech/RDGScanner)
- [SecurityLab.ru - Exploits published for critical Windows RD Gateway vulnerabilities](https://securitylab.ru/news/504405.php)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3828