CVE-2026-42985

What it actually does

This is a client-side remote code execution vulnerability in Microsoft Remote Desktop Client and related Windows App components. A memory corruption flaw, described as a heap-based buffer overflow, can be triggered when a vulnerable client processes malicious Remote Desktop Protocol content from an attacker-controlled or compromised RDP endpoint. Because the CVSS vector requires user interaction, exploitation typically depends on convincing a user to initiate or open a Remote Desktop connection. Successful exploitation can allow attacker-supplied code to run in the context of the user running the Remote Desktop client, potentially enabling credential theft, malware execution, lateral movement preparation, and persistence on the client system.

Why it matters to the business

Organizations that allow users or administrators to connect to external, partner, lab, contractor, or unmanaged RDP hosts are at higher risk because a malicious server can compromise the connecting workstation rather than the server. Impact can include takeover of administrator workstations, theft of saved or entered credentials, installation of malware, data access under the user’s privileges, and disruption of endpoint operations. The vulnerability is high severity with network-based attack reach and low attack complexity, but it is not currently listed in CISA KEV, is not reported as ransomware-associated, has no listed public exploit maturity, and has a low, flat EPSS score, so remediation should be prioritized but can generally follow an expedited patch cycle rather than emergency incident response unless exposure to untrusted RDP destinations is common.

How an attack unfolds

An attacker prepares a malicious RDP service, gateway path, or connection target that returns specially crafted protocol data intended to corrupt heap memory in the vulnerable Remote Desktop client. The attacker then persuades a victim to connect, for example through a phishing message, a shared .rdp file, a link using an RDP-related URI, a support pretext, or by compromising a server that legitimate users already access. When the vulnerable client parses the malicious response, memory corruption occurs and attacker-controlled code may execute on the client endpoint. The attacker’s code would run with the privileges of the logged-on user, after which the attacker may attempt to dump or intercept credentials, access local files, establish persistence, disable defenses, or pivot using the victim’s network access.

How to fix it

Apply the Microsoft security updates that address CVE-2026-42985 across affected Windows and Remote Desktop Client installations, including supported Windows 10, Windows 11, Windows Server, Microsoft Remote Desktop Client, and Microsoft Windows App deployments. Because no exact fixed package versions were provided, use the relevant Microsoft Security Update Guide entry and Windows Update, WSUS, Microsoft Configuration Manager, Intune, or Microsoft Store update channels to confirm the applicable patched build for each affected product. Update both operating system components and separately distributed Remote Desktop or Windows App clients where present. As interim risk reduction, restrict outbound RDP connections to trusted destinations, block or warn on unsolicited .rdp files, prevent automatic handling of RDP URI links where feasible, disable saved credentials for untrusted RDP targets, and avoid using privileged accounts to connect to unknown or unmanaged RDP servers.

How to confirm the fix worked

Confirm that Windows endpoints and servers have installed the relevant June 2026 or later Microsoft security update that remediates this vulnerability, and verify that Microsoft Remote Desktop Client or Windows App instances are updated through their appropriate distribution channel. Inventory systems for affected products including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2016, 2019, 2022, 2025; Microsoft Remote Desktop Client; and Microsoft Windows App. Validate exposure controls by confirming that outbound RDP traffic to untrusted internet destinations is blocked or monitored, that .rdp file execution from email and web download locations is controlled, and that users cannot silently launch RDP sessions from untrusted links. Review endpoint management reports, Windows Update compliance, Microsoft Store app versions, and vulnerability scanner results to ensure no vulnerable client versions remain.

Typical attack path

1. Identify users or administrators likely to initiate Remote Desktop sessions, especially those connecting to external or unmanaged systems.
2. Stand up or compromise an RDP-accessible host, gateway, or connection broker capable of serving malicious protocol content.
3. Deliver a lure such as a malicious .rdp file, RDP URI, support instruction, or link to the attacker-controlled host.
4. Wait for the victim to launch Microsoft Remote Desktop Client, Windows App, or mstsc.exe and initiate the connection.
5. Trigger the heap memory corruption condition during client-side protocol handling.
6. Execute code in the context of the victim user on the client device.
7. Perform post-exploitation actions such as credential theft, persistence, payload deployment, reconnaissance, or lateral movement.

How to detect it

Investigate signs that a Remote Desktop client process connected to an untrusted host and then crashed, spawned unusual processes, or was followed by suspicious endpoint behavior. Useful telemetry includes Windows Security logs, Sysmon or EDR process creation events, DNS logs, proxy logs, firewall logs, NetFlow, Windows Error Reporting, Application event logs, Defender for Endpoint alerts, and email/web gateway records for delivered .rdp files or RDP URI links. Look for mstsc.exe, msrdc.exe, or Windows App processes launched from downloaded .rdp files, email attachments, browser cache locations, temporary directories, or chat/collaboration sync folders. Correlate outbound RDP connections over TCP/3389 or RDP gateway traffic over HTTPS to unfamiliar hosts with subsequent Application Error or Windows Error Reporting events involving Remote Desktop client binaries. Post-exploitation hunting should focus on suspicious child processes from RDP client processes, credential dumping attempts, new persistence mechanisms, abnormal PowerShell or command shell execution, new scheduled tasks, new Run keys, unexpected remote access tools, and outbound connections to previously unseen destinations. There are no public exploit-specific indicators in the supplied data, so detections should be behavior-based and focused on anomalous RDP client activity and crash-to-execution patterns.

• mstsc.exe
• msrdc.exe
• msrdcw.exe
• .rdp
• ms-rd:
• tcp/3389
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Faulting application name: msrdcw.exe
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Application Error
• Remote Desktop Connection
• Microsoft Remote Desktop
• Windows App
• \AppData\Local\Temp\*.rdp
• \Users\Public\*.rdp
• \Downloads\*.rdp
• HKCU\Software\Microsoft\Terminal Server Client
• HKCU\Software\Microsoft\Terminal Server Client\Servers

What your security team should do

• Prioritize patching endpoints used by administrators, help desk staff, developers, and users who frequently connect to RDP hosts outside tightly managed infrastructure.
• Update Microsoft Remote Desktop Client, Microsoft Windows App, and affected Windows operating systems through approved Microsoft update channels; track completion separately for Store-delivered clients and OS-delivered mstsc.exe components.
• Restrict outbound TCP/3389 and RDP-over-HTTPS access to approved destinations, gateways, or VPN paths; alert on direct RDP connections to new or internet-hosted systems.
• Block or quarantine unsolicited .rdp files from email, collaboration platforms, and web downloads, especially when they originate externally.
• Educate users and administrators not to connect to unknown RDP servers or open unexpected Remote Desktop connection files.
• Monitor for mstsc.exe, msrdc.exe, or Windows App crashes followed by suspicious child processes, credential access behavior, persistence creation, or unusual outbound network activity.
• Review saved RDP credentials and discourage use of privileged accounts for connections to systems that are not fully trusted.
• Because this is not currently KEV-listed and EPSS is low and flat, use expedited vulnerability management unless threat intelligence changes, exploitation becomes public, or external RDP connection exposure is significant.