CVE-2026-42913: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow exists in the Microsoft Remote Desktop Client for Windows. The vulnerability is reachable over the network without any authentication, but requires a victim to interact with a malicious server or content, and exploitation is complicated by memory-layout factors that lower reliability. Successful exploitation gives an attacker full remote code execution on the victim's machine. Patched-image rebuilds at the fix versions (including 1.2.7214.0, 10.0.20348.5256, 10.0.22631.7219, 10.0.26100.8655, and 10.0.26100.32995) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Remote Desktop Client over the network, meaning the victim's host must have outbound connectivity to an attacker-controlled server or must be directed to malicious RDP content.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the vulnerability is exploitable by an unauthorized attacker.

• Victim interactionRequired

  The victim must take an action such as connecting to a malicious RDP server or opening a crafted file, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must contend with memory-layout variability or other environmental conditions that reduce reliability and require more precise staging.

Blast Radius

• A successful attacker achieves arbitrary code execution in the context of the victim user, able to run any process or command on the victim's machine.
• Confidentiality is fully compromised: the attacker can read files, credentials, session tokens, and any data accessible to the victim account.
• Integrity is fully compromised: the attacker can write, modify, or delete files and system state on the victim host.
• Availability is fully compromised: the attacker can crash, disable, or otherwise render the victim's system or its services unusable.