CVE-2026-44801: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow exists in Microsoft Remote Desktop Client for Windows that is reachable over the network without any prior authentication. Exploitation requires the victim to take an action, such as connecting to a malicious RDP server, and the attack involves complex conditions the attacker must satisfy. Successful exploitation gives the attacker full remote code execution on the victim's machine. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's Remote Desktop Client over the network, typically by operating or spoofing a malicious RDP server that the client connects to.

• AuthenticationNot required

  No credentials or prior account access are required; the attacker exploits the client before any authentication handshake completes.

• Victim interactionRequired

  The victim must initiate or be socially engineered into initiating an RDP connection to an attacker-controlled server.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific race conditions, timing constraints, or memory layout prerequisites to reliably trigger the overflow.

Blast Radius

• The attacker executes arbitrary code in the context of the user running Remote Desktop Client, gaining full control over that user's session.
• Confidential data accessible to that user, including credentials, documents, and session tokens, is readable by the attacker.
• The attacker can write or modify files, registry keys, and application data on the victim host.
• The attacker can crash or destabilize the Remote Desktop Client process and any dependent workflows.