CVE-2026-42913

What it actually does

This vulnerability is a heap-based buffer overflow in Remote Desktop Client. A malicious or compromised Remote Desktop Protocol endpoint can send specially crafted network data that corrupts client memory when a user connects, potentially allowing code execution in the context of the logged-on user running the client. The CVSS vector indicates network reachability, no attacker authentication requirement, high confidentiality/integrity/availability impact, and required user interaction. Although the assigned family is listed as RaceCondition, the supplied description indicates memory corruption via heap overflow.

Why it matters to the business

Successful exploitation could let an attacker take control of a workstation used to initiate Remote Desktop connections, steal credentials or session data, install malware, pivot to other systems, or disrupt operations. Risk is highest for administrators, help desk staff, contractors, and users who connect to externally hosted or third-party RDP systems. The vulnerability is not currently listed in CISA KEV, has no reported ransomware use, has no public exploit maturity in the provided data, and has a low, flat EPSS score, so prioritization should be risk-based but still timely because exploitation can result in full code execution.

How an attack unfolds

An attacker prepares a malicious RDP service or compromises a legitimate RDP endpoint. The attacker then convinces a target to initiate an RDP connection, for example through phishing, social engineering, a poisoned shortcut, or abuse of an expected remote support workflow. During connection negotiation or session handling, the malicious server returns crafted protocol data that triggers heap corruption in the Remote Desktop Client. If the memory corruption is shaped successfully, attacker-controlled code executes on the client system under the privileges of the user who launched the connection. The attacker can then run post-exploitation tooling, steal saved credentials or tokens, establish persistence, or move laterally depending on the user’s access.

How to fix it

Apply the vendor security update for Remote Desktop Client on all supported platforms as soon as it is available for the affected product versions. Because no exact affected products or fixed versions were provided, use the vendor advisory and operating system update catalog to identify the applicable patched builds. Prioritize systems used by administrators, IT support, third parties, jump-box users, and anyone who connects to external or untrusted RDP endpoints. Where immediate patching is not possible, reduce exposure by blocking outbound RDP to untrusted destinations, disabling use of saved or downloaded RDP files from untrusted sources, restricting clipboard/drive redirection where feasible, using hardened jump hosts, and enforcing application control to limit child process execution from Remote Desktop Client.

How to confirm the fix worked

Confirm endpoints have installed the vendor patch level that includes the fix for this Remote Desktop Client vulnerability. Validate by checking operating system update history, endpoint vulnerability scan results, and software inventory for Remote Desktop Client components. Test control effectiveness by confirming outbound RDP is limited to approved destinations and that users cannot launch untrusted RDP files or connect to unauthorized RDP servers. For high-risk systems, verify that mstsc.exe or equivalent Remote Desktop Client binaries are at patched file versions according to the vendor advisory, and confirm EDR policies alert on suspicious child processes or memory-injection behavior originating from the client.

Typical attack path

1. Set up or compromise an RDP server reachable over the network.
2. Craft malicious RDP responses designed to trigger the heap-based buffer overflow in the client.
3. Lure a user into connecting to the malicious RDP endpoint using Remote Desktop Client.
4. Trigger memory corruption during the RDP session negotiation or data handling path.
5. Execute attacker-controlled code in the context of the connected user.
6. Spawn or inject into local processes, collect credentials or data, and establish persistence or lateral movement if privileges allow.

How to detect it

There are no known public, vulnerability-specific indicators in the provided data, so detection should focus on behavioral evidence. Review endpoint telemetry for Remote Desktop Client crashes, Windows Error Reporting records, abnormal child processes spawned by mstsc.exe, process injection into or from mstsc.exe, and unexpected outbound RDP connections. Useful log sources include EDR process telemetry, Windows Security logs, Sysmon, Windows Application logs, Windows Error Reporting, firewall/proxy/VPN logs, DNS logs, and email/web download telemetry for RDP files. Look for a sequence where a user launches an RDP file or mstsc.exe, connects to an unusual RDP host, the client crashes or shows access-violation errors, and then suspicious processes such as PowerShell, cmd, mshta, rundll32, regsvr32, wscript, or cscript execute. Also investigate newly created persistence mechanisms, credential access activity, or lateral movement shortly after suspicious Remote Desktop Client activity.

• mstsc.exe
• Faulting application name: mstsc.exe
• Remote Desktop Connection
• Windows Error Reporting
• Exception code: 0xc0000005
• Event ID 1000
• Event ID 1001
• mstsc.exe -> cmd.exe
• mstsc.exe -> powershell.exe
• mstsc.exe -> pwsh.exe
• mstsc.exe -> wscript.exe
• mstsc.exe -> cscript.exe
• mstsc.exe -> mshta.exe
• mstsc.exe -> rundll32.exe
• mstsc.exe -> regsvr32.exe
• mstsc.exe -> certutil.exe
• mstsc.exe -> bitsadmin.exe
• .rdp
• TCP/3389

What your security team should do

• Patch Remote Desktop Client on administrator, help desk, contractor, and jump-host systems first, then complete broad endpoint remediation.
• Restrict outbound RDP connections to approved destinations using firewall, proxy, VPN, or zero-trust access controls.
• Block or warn on RDP files and links received via email, chat, browser downloads, and collaboration platforms unless from trusted sources.
• Create detections for mstsc.exe spawning command shells, scripting engines, LOLBins, or unknown executables.
• Review recent RDP client crash telemetry and Windows Error Reporting events for signs of exploitation attempts.
• Hunt for outbound RDP connections to unusual external IPs or recently registered domains, especially followed by suspicious process execution.
• Ensure EDR is enabled on workstations that initiate RDP connections and that memory-exploitation and child-process protections are enforced.
• Educate administrators and support users not to connect to unsolicited or externally supplied RDP endpoints.