CVE-2026-42909: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Remote Desktop Client allows a remote, unauthenticated attacker to execute arbitrary code on the connecting client machine. The attack is reachable over the network but requires the victim to connect to a malicious or compromised RDP server, and exploitation is made more difficult by high attack complexity conditions such as memory layout requirements. Successful exploitation gives the attacker full code execution on the victim's machine, with access to confidential data, the ability to modify files and processes, and the ability to crash or take over the affected client. Patched-image rebuilds at the fix versions listed above are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's client over the network; specifically, the victim must connect to an attacker-controlled or compromised RDP server reachable from the victim's network.

• AuthenticationNot required

  No authentication is required on the attacker's side; the attacker operates as an unauthenticated party hosting or controlling a malicious RDP server endpoint.

• Victim interactionRequired

  The victim must actively initiate an RDP connection to the malicious server, making this a social-engineering or supply-chain-redirect scenario.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation depends on environmental factors such as heap memory layout or timing conditions that the attacker cannot fully control.

Blast Radius

• The attacker gains arbitrary code execution in the context of the user running the Remote Desktop Client on the connecting machine.
• All data accessible to that user account, including stored credentials, session tokens, and local files, can be read or exfiltrated.
• The attacker can modify files, install software, or alter running processes owned by the victim user.
• The affected Remote Desktop Client process and any dependent services can be crashed or hijacked.