CVE-2026-48563: Remote Desktop Client Remote Code Execution Vulnerability

Synopsis

A heap-based buffer overflow in the Microsoft Remote Desktop Client allows an unauthenticated attacker to execute arbitrary code on the victim's machine by serving a malicious RDP server over the network. The vulnerability is reachable remotely but requires the victim to initiate a connection, and exploitation is not straightforward due to high attack complexity. Successful exploitation gives the attacker full control over the affected host, including the ability to read, modify, and destroy data. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, specifically by operating or controlling a malicious RDP server that the victim's client connects to.

• AuthenticationNot required

  No credentials or prior account access are needed on the targeted system; the attacker operates from an unauthenticated position.

• Victim interactionRequired

  The victim must actively initiate an RDP connection to the attacker-controlled server, requiring some form of social engineering or redirect.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation depends on environmental factors such as memory layout conditions that the attacker cannot fully control.

Blast Radius

• Reads sensitive data accessible to the Remote Desktop Client process, including credentials, session tokens, and locally cached files.
• Writes or modifies files and configuration on the host under the permissions of the compromised process.
• Executes arbitrary code in the context of the victim user, enabling installation of malware or lateral movement tooling.
• Crashes or destabilizes the Remote Desktop Client process, disrupting the user's session.