CVE-2026-47654: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in the Microsoft Remote Desktop Client allows a remote, unauthenticated attacker to execute arbitrary code on affected systems. The attacker must reach the service over the network and requires the victim to interact with a malicious server or link, but no account credentials are needed. Successful exploitation gives the attacker full code execution, with high impact on confidentiality, integrity, and availability. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected versions of Windows Server 2016 through 2025.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Remote Desktop Client service over the network; over-the-network exposure is the primary attack surface.

• AuthenticationNot required

  No account credentials are needed; the attacker can exploit the vulnerability without authenticating to the target system.

• Victim interactionRequired

  The victim must interact with a malicious RDP server or crafted link, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must meet specific conditions or environmental factors beyond the attacker's direct control to reliably trigger the overflow.

Blast Radius

• A successful attacker achieves arbitrary code execution in the context of the Remote Desktop Client process on the victim host.
• The attacker reads sensitive data accessible to that process, including credentials, session tokens, and files the current user can access.
• The attacker modifies files, registry keys, or persisted data within the victim user's privilege scope.
• The attacker can crash or destabilize the affected client process, denying availability of the Remote Desktop service to the victim.