CVE-2026-42909

What it actually does

CVE-2026-42909 is a heap-based buffer overflow in Microsoft Remote Desktop Client and related Windows client components. A remote, unauthenticated attacker can trigger memory corruption by causing a vulnerable client to process malicious Remote Desktop Protocol data, potentially achieving arbitrary code execution in the context of the user running the client. The CVSS vector indicates network reachability, no privileges required, user interaction required, high attack complexity, and high confidentiality, integrity, and availability impact. Although the supplied family is RaceCondition, the described vulnerability behavior is memory corruption leading to client-side remote code execution.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a user workstation or administrative jump system after the user connects to a malicious or compromised remote desktop endpoint. This can lead to credential theft, malware installation, lateral movement, data access, and disruption of business operations. The vulnerability affects many supported Windows desktop and server versions, as well as Microsoft Remote Desktop Client and Windows App, so exposure may be broad in organizations that use RDP for administration, virtual desktops, support workflows, or remote access. It is not currently listed in CISA KEV, is not reported as used in ransomware campaigns, has no known mature public exploit in the provided data, and has low, flat EPSS activity, but the potential impact remains high because exploitation can result in code execution.

How an attack unfolds

An attacker first prepares or compromises an RDP-compatible service that returns specially crafted protocol data. The attacker then entices a user to initiate a Remote Desktop connection to that endpoint, for example through phishing, a fake support workflow, a malicious connection file, or redirection from a compromised host. When the vulnerable Remote Desktop Client processes the crafted server response, heap memory corruption occurs. If the attacker successfully controls the corrupted memory state, they can execute code on the client machine with the privileges of the user who launched the RDP session. From there, the attacker may deploy payloads, steal cached credentials or session material, establish persistence, and pivot to other systems accessible from the compromised endpoint.

How to fix it

Apply the applicable Microsoft security updates for all affected Windows versions and update Microsoft Remote Desktop Client and Windows App through the official Microsoft update channels. Because no exact fixed version list was provided, use Microsoft’s security update guidance, Windows Update, Microsoft Update Catalog, WSUS, Intune, or other patch management tooling to confirm the installed builds include the fix for CVE-2026-42909. Update or remove standalone Remote Desktop clients on managed endpoints, including Store-delivered or packaged versions. As compensating controls, restrict users from connecting to untrusted RDP servers, block outbound RDP to the internet where not required, require connections through approved gateways, disable automatic opening of .rdp files from email or browsers where feasible, and use endpoint protection exploit mitigation for Microsoft Remote Desktop Client processes.

How to confirm the fix worked

Confirm that affected Windows systems have installed the relevant Microsoft security update released for this vulnerability or a later cumulative update. Validate Microsoft Remote Desktop Client and Windows App versions against Microsoft’s advisory or enterprise software inventory once fixed versions are published by the vendor. Use vulnerability scanning, endpoint inventory, and patch compliance reporting to identify systems still running vulnerable builds. Test that outbound RDP access is limited to approved destinations and that users cannot freely initiate RDP sessions to untrusted internet hosts. Where possible, perform a controlled verification with an authenticated vulnerability scanner rather than attempting exploitation, since reliable exploitation would involve memory corruption and may crash client applications.

Typical attack path

1. Set up or compromise an RDP endpoint capable of delivering malicious protocol responses.
2. Lure a victim into opening an RDP connection using Microsoft Remote Desktop Client, Windows App, or built-in Remote Desktop Connection.
3. Trigger the heap-based buffer overflow during protocol handling on the client side.
4. Achieve code execution in the context of the current user if exploitation succeeds.
5. Run post-exploitation tooling, steal credentials or tokens, and establish persistence.
6. Use the compromised endpoint as a foothold for lateral movement or additional attacks.

How to detect it

To determine whether exploitation may have already occurred, review endpoint telemetry around Microsoft Remote Desktop Client usage and crashes. Key log sources include Windows Application event logs, Windows Error Reporting, EDR telemetry, Sysmon process creation and network events, firewall/proxy logs for outbound RDP, and registry artifacts showing recent RDP destinations. Look for Remote Desktop client crashes immediately after outbound connections to unusual or external RDP servers, especially access violations or heap-corruption-style faults. Investigate any unexpected child processes launched by mstsc.exe, msrdc.exe, or Windows App components, such as command shells, scripting engines, credential tools, downloaders, or persistence mechanisms. Correlate suspicious RDP client activity with user reports of opening unsolicited .rdp files, connecting to new support portals, or being redirected to unfamiliar remote desktop hosts. Because no public exploit indicators or campaign-specific infrastructure were provided, detection should focus on behavioral evidence: anomalous outbound TCP/3389 connections, client crashes, exploit mitigation alerts, and post-exploitation activity following RDP client execution.

• mstsc.exe
• msrdc.exe
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Exception code: 0xc0000005
• Event ID 1000
• Event ID 1001
• HKCU\Software\Microsoft\Terminal Server Client\Default
• HKCU\Software\Microsoft\Terminal Server Client\Servers
• outbound TCP/3389

What your security team should do

• Prioritize patching endpoints and administrative workstations that commonly initiate RDP sessions, including helpdesk, IT administration, VDI, and jump-box systems.
• Inventory all Remote Desktop Client, Windows App, and supported Windows versions listed as affected, including Store-delivered applications that may not be covered by traditional OS patch reporting.
• Restrict outbound RDP traffic to approved remote access gateways, management networks, and known business destinations.
• Harden handling of .rdp files from email, web downloads, collaboration platforms, and external sources.
• Monitor for crashes, exploit-prevention alerts, or abnormal child processes spawned by Remote Desktop client applications.
• Educate users and administrators not to connect to unknown RDP endpoints or open unsolicited RDP connection files.
• Review RDP client connection history on systems used by privileged users if suspicious activity is suspected.
• Track Microsoft’s advisory for exact fixed builds and update detection logic when definitive version data is available.