CVE-2026-42993: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow vulnerability exists in the Microsoft Remote Desktop Client across multiple versions of Windows 10, Windows 11, and Windows Server 2022. The flaw is reachable over the network without authentication, but requires the victim to interact with a malicious server or link, and exploitation depends on meeting specific memory-layout conditions (high attack complexity). Successful exploitation gives an attacker full remote code execution on the victim's machine. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Remote Desktop Client over the network, typically by hosting or controlling a malicious RDP server that the client connects to.

• AuthenticationNot required

  No authentication or account credentials are required on the attacker's side; the attacker operates as an unauthenticated party relative to the target system.

• Victim interactionRequired

  The victim must take an action such as opening a malicious RDP file or connecting to an attacker-controlled server, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific memory-layout or timing conditions beyond basic delivery, making reliable exploitation harder to achieve consistently.

Blast Radius

• The attacker executes arbitrary code in the context of the logged-in user on the victim's machine.
• Confidential data accessible to that user account, including files, credentials, and session tokens, can be read or exfiltrated.
• The attacker can modify or delete files and persistent data owned by the compromised user.
• The affected Remote Desktop Client process and any dependent services can be crashed or rendered unavailable.