CVE-2026-47289: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in Microsoft Remote Desktop Client allows an unauthenticated attacker to execute arbitrary code on the victim's machine by having the victim connect to a malicious RDP server over a network. No credentials are required on the attacker's side, but the victim must initiate a connection, such as by clicking a crafted link or visiting a page that triggers an RDP session. Successful exploitation gives the attacker full code execution on the affected Windows host. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version of Windows.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be reachable over the network, as the victim's Remote Desktop Client connects outbound to an attacker-controlled RDP server.

• AuthenticationNot required

  No credentials or account on the target system are required; the attacker operates as an unauthenticated party hosting the malicious server.

• Victim interactionRequired

  The victim must actively initiate an RDP connection to the attacker-controlled server, for example by clicking a crafted link or being redirected through a phishing page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the user running the Remote Desktop Client on the victim's Windows host.
• Confidential data accessible to that user account, including files, credentials cached in memory, and session tokens, is readable by the attacker.
• The attacker can write or modify files and registry entries within the permissions of the compromised user account.
• The attacker can crash or terminate the Remote Desktop Client process and any dependent services, disrupting the user's session.