CVE-2026-42985: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in Microsoft Remote Desktop Client allows an unauthenticated attacker to reach the vulnerability over the network and execute arbitrary code on the affected system. Exploitation requires the victim to interact with a malicious server or specially crafted content, but no credentials are needed on the attacker side. Successful exploitation gives the attacker full code execution in the context of the connecting user. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected Remote Desktop Client over the network, meaning the client must be able to connect to an attacker-controlled server or resource reachable across the internet or internal network.

• AuthenticationNot required

  No credentials or prior account access are needed on the attacker side; the attack targets the connecting client without any authentication requirement.

• Victim interactionRequired

  The victim must initiate or be socially engineered into initiating a Remote Desktop connection to a malicious server, making user interaction a necessary step for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout luck, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the security context of the logged-in user on the connecting machine.
• Confidentiality impact is high: the attacker reads files, credentials, session tokens, and any data accessible to that user.
• Integrity impact is high: the attacker writes, modifies, or deletes files and data on the compromised host.
• Availability impact is high: the attacker crashes or fully disrupts the affected system or its services.