CVE-2026-32157

What it actually does

This is a use-after-free vulnerability in Microsoft Remote Desktop Client. A malicious or compromised RDP server can trigger memory corruption in the client during a Remote Desktop connection and cause attacker-controlled code to execute in the context of the user running the client. The CVSS vector indicates network reachability, low attack complexity, no attacker authentication requirement, and required user interaction because a user must initiate or be induced into initiating a Remote Desktop connection. Successful exploitation can provide full confidentiality, integrity, and availability impact on the client workstation or server from which the RDP client is launched.

Why it matters to the business

If exploited, this flaw can allow compromise of administrator workstations, jump boxes, help desk systems, or servers used to connect to other machines over Remote Desktop. An attacker who controls or impersonates an RDP endpoint could use the vulnerability to steal credentials, deploy malware, pivot into internal systems, or disrupt operations. The issue affects many supported Windows desktop and server versions, so exposure may be broad in organizations that use Remote Desktop for administration or support. It is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score that has remained flat over 30 days, but the high technical impact warrants timely patching, especially on privileged administrator endpoints.

How an attack unfolds

An attacker first gains control of an RDP server or presents a malicious RDP service reachable over the network. The attacker then persuades a target user to connect to that server using Microsoft Remote Desktop Client, commonly through phishing, fake support instructions, poisoned documentation, or by compromising a legitimate server the user is expected to administer. When the client processes malicious RDP protocol data, a use-after-free condition is triggered, causing the client to reference memory that has already been released. With reliable heap manipulation, the attacker can redirect execution flow and run arbitrary code on the client system under the privileges of the connecting user. If the user has administrative privileges or cached credentials, the attacker can use that foothold for credential theft, persistence, lateral movement, and further compromise.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32157 for all affected Windows and Remote Desktop Client installations. Because no exact fixed build numbers were provided, use the latest cumulative security updates from Microsoft for the relevant Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025 releases. Prioritize systems used for administration, help desk activity, remote support, privileged access workstations, jump hosts, and servers from which administrators initiate outbound RDP sessions. As mitigations until patching is complete, restrict outbound RDP connections to approved destinations, block or alert on RDP to the internet, require users to connect only to trusted hosts, disable saved credentials where feasible, use Remote Credential Guard for administrative RDP, and reduce local administrator rights on workstations.

How to confirm the fix worked

Confirm that all affected systems have installed the relevant Microsoft cumulative security update released for this vulnerability or a later superseding update. Validate through centralized patch management, Microsoft Update history, Windows Update for Business, WSUS, Microsoft Intune, Configuration Manager, or vulnerability scanning authenticated against endpoints. Test representative systems by confirming the Remote Desktop Client version and Windows build level are at or above the patched baseline defined by Microsoft for the applicable operating system. Verify that egress controls prevent RDP connections to unapproved external addresses and that monitoring is enabled for outbound RDP usage. For exposure validation, inventory systems where mstsc.exe is present and used, identify endpoints with frequent outbound TCP/3389 connections, and prioritize remediation for systems used by privileged users.

Typical attack path

1. Prepare or compromise an RDP server that can deliver malicious protocol responses to connecting clients.
2. Lure a target user, administrator, or support technician into initiating an RDP connection to the attacker-controlled or compromised server.
3. Trigger the use-after-free condition in Microsoft Remote Desktop Client through crafted RDP traffic during session negotiation or interaction.
4. Exploit memory corruption to execute code on the client system in the context of the logged-on user.
5. Deploy a payload such as a credential stealer, remote access tool, loader, or post-exploitation framework.
6. Harvest credentials, tokens, RDP connection history, and administrative access from the compromised client.
7. Move laterally or access additional systems using the victim user's privileges.

How to detect it

To assess whether exploitation has already occurred, focus on client-side telemetry from systems that initiate Remote Desktop sessions. Review Windows Security logs, Sysmon, EDR process telemetry, firewall logs, DNS logs, proxy logs where applicable, and network flow data for outbound RDP connections to unfamiliar or external hosts. Look for mstsc.exe connecting to unusual destinations, followed shortly by suspicious child processes, command execution, credential dumping behavior, persistence creation, or unexpected network beacons. Useful Windows events include Security process creation events if command-line auditing is enabled, Sysmon process creation, network connection, DNS query, image load, and file creation events, and TerminalServices client logs that record RDP connection activity. Investigate cases where mstsc.exe spawns command shells, scripting engines, LOLBins, archive tools, downloaders, or unsigned binaries, because Remote Desktop Client normally should not create arbitrary child processes. Also inspect endpoint crash telemetry such as Windows Error Reporting entries for mstsc.exe crashes near the time of connections to untrusted RDP servers, as failed exploitation attempts may cause client instability. No public exploit indicators, threat actor names, KEV exploitation, or ransomware campaign linkage were provided, so detection should be behavior-based rather than signature-only.

• mstsc.exe
• TCP/3389
• UDP/3389
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• Microsoft-Windows-Windows Error Reporting
• Faulting application name: mstsc.exe
• Process Create: mstsc.exe
• Image: C:\Windows\System32\mstsc.exe
• Image: C:\Windows\SysWOW64\mstsc.exe
• ParentImage: C:\Windows\System32\mstsc.exe
• ParentImage: C:\Windows\SysWOW64\mstsc.exe
• mstsc.exe -> cmd.exe
• mstsc.exe -> powershell.exe
• mstsc.exe -> pwsh.exe
• mstsc.exe -> wscript.exe
• mstsc.exe -> cscript.exe
• mstsc.exe -> mshta.exe
• mstsc.exe -> rundll32.exe
• mstsc.exe -> regsvr32.exe
• mstsc.exe -> certutil.exe
• mstsc.exe -> bitsadmin.exe

What your security team should do

• Patch all affected Windows desktop and server systems with the latest applicable Microsoft cumulative security updates, prioritizing privileged administrator workstations and jump hosts.
• Inventory outbound RDP usage and identify users or systems that connect to external or unmanaged RDP servers.
• Restrict outbound TCP/3389 and UDP/3389 to approved destinations using firewalls, secure web gateways, VPN policy, or endpoint controls.
• Harden administrative RDP workflows with Remote Credential Guard, privileged access workstations, least privilege, and credential isolation.
• Educate administrators and support staff not to initiate RDP sessions to unverified hosts or hosts supplied through email, chat, tickets, or documentation without validation.
• Add detections for unusual mstsc.exe execution, outbound RDP connections to new or internet-facing destinations, and child processes spawned from mstsc.exe.
• Review recent RDP client activity for signs of exploitation, especially around connections to unfamiliar destinations followed by process creation, credential access, or persistence activity.
• Because the issue is not currently KEV-listed and EPSS is low and stable, handle as high-impact but not confirmed-widespread exploitation unless local telemetry indicates otherwise.