CVE-2026-47653: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in the Microsoft Remote Desktop Client allows an unauthenticated attacker to reach the vulnerable component over a network and execute arbitrary code on the affected machine. The CVSS vector shows no authentication is required, but a victim must take an action such as connecting to a malicious RDP server for exploitation to succeed. Successful exploitation gives the attacker full code execution in the context of the connecting user, enabling data theft, system modification, or service disruption. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's machine over the network; the vulnerable client initiates an outbound RDP connection to an attacker-controlled server, so the service must be network-accessible or the victim must be routable to the malicious host.

• AuthenticationNot required

  No authentication is required; the attacker does not need any account or credential on the target system before exploitation.

• Victim interactionRequired

  The victim must initiate an RDP connection to a malicious server, requiring the attacker to socially engineer the victim into connecting, such as through a phishing link or crafted .rdp file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Reads files, credentials, and session tokens accessible to the connecting user's account.
• Writes or modifies files and registry entries within the user's permission scope.
• Executes arbitrary processes on the victim host under the compromised user context.
• Crashes or disrupts the Remote Desktop Client session and any dependent user-space processes.