CVE-2026-42992: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in Microsoft Remote Desktop Client allows a remote, unauthenticated attacker to execute arbitrary code on the victim's machine. The attack is delivered over the network but requires high complexity conditions and a user interaction step, derived from the CVSS vector (AV:N/AC:H/PR:N/UI:R). Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the fix versions (including 10.0.14393.9234, 10.0.17763.8880, 10.0.19044.7417, and 10.0.19045.7417) are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Remote Desktop Client service over the network; the service must be exposed or the victim must connect to an attacker-controlled RDP endpoint.

• AuthenticationNot required

  No credentials or existing account are needed; the attack can be launched by an unauthenticated party (PR:N).

• Victim interactionRequired

  The victim must take an action, such as connecting to a malicious RDP server, making this dependent on a social-engineering or phishing step (UI:R).

• Attack complexityDetail

  Exploitation requires meeting high-complexity preconditions such as precise timing, memory layout manipulation, or other environmental factors (AC:H), making reliable exploitation non-trivial.

Blast Radius

• A successful attacker reads all data accessible to the Remote Desktop Client process, including session credentials and files in scope at runtime (C:H).
• A successful attacker writes or modifies data on the victim's host, including files, registry entries, or in-memory state (I:H).
• A successful attacker crashes or fully disrupts the affected Remote Desktop Client process and dependent services (A:H).
• Because the overflow enables arbitrary code execution in the context of the client process, the attacker gains persistent foothold potential on the victim's workstation or server.