CVE-2026-44799: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in Microsoft Remote Desktop Client allows a remote, unauthenticated attacker to execute arbitrary code on the connecting client machine. The vulnerability is reachable over the network but requires the victim to connect to a malicious or compromised RDP server, and exploitation involves non-trivial memory-layout conditions. Successful exploitation gives the attacker full code execution in the context of the connecting user, enabling data theft, tampering, and service disruption. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, specifically by operating or controlling an RDP server that the victim's client connects to.

• AuthenticationNot required

  No authentication is required; the attacker does not need any account on the target system before exploitation.

• Victim interactionRequired

  The victim must actively initiate an RDP connection to a malicious or compromised server, making social engineering or infrastructure compromise a prerequisite.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for specific memory-layout or heap-state conditions that are not reliably reproducible without careful setup.

Blast Radius

• Executes arbitrary code in the security context of the logged-in user on the connecting client machine.
• Reads files, credentials, and session tokens accessible to that user account.
• Writes or modifies files and data accessible to that user, including persisted credentials or configuration files.
• Crashes or destabilizes the Remote Desktop Client process, disrupting the user's session and any dependent workflows.