CVE-2026-42992

What it actually does

CVE-2026-42992 is a heap-based buffer overflow in Microsoft Remote Desktop Client components. A malicious or attacker-controlled RDP endpoint can send crafted protocol data that corrupts heap memory in the client process and may allow arbitrary code execution on the connecting system. Because the CVSS vector includes user interaction and high attack complexity, exploitation generally requires convincing a user or process to initiate an RDP connection and may require version-specific heap manipulation, but successful exploitation can compromise confidentiality, integrity, and availability in the context of the affected client process or signed-in user.

Why it matters to the business

An attacker who convinces a user to connect to a malicious remote desktop endpoint could gain code execution on that user’s workstation or server session, enabling malware installation, credential theft, data access, and lateral movement. The affected product set is broad across Windows 10, Windows 11, Windows Server, and Microsoft Windows App, so organizations with routine RDP usage, helpdesk workflows, jump-host administration, or user access to external RDP destinations have wider exposure. Current public exploitation indicators are limited: EPSS is low and flat at 0.00461, no public exploit maturity is reported, and it is not listed in CISA KEV or known ransomware use, so urgency should be risk-based but still prioritized for systems and users that initiate RDP connections.

How an attack unfolds

An attacker prepares a malicious RDP service or infrastructure that emits specially crafted Remote Desktop protocol responses designed to trigger a heap overflow in vulnerable Remote Desktop Client code. The attacker then causes a target to initiate a connection, commonly through phishing, a malicious .rdp file, a helpdesk or support pretext, a link to an attacker-controlled host, or by compromising an RDP destination the victim already trusts. During connection negotiation or subsequent protocol handling, the crafted network data corrupts heap memory in the client process, potentially allowing the attacker to redirect execution flow and run code on the victim machine. If successful, the payload would execute with the privileges of the user running the client, after which the attacker may deploy persistence, steal browser or Windows credentials, access files, or use the compromised endpoint as a foothold for internal movement. The high attack complexity suggests exploitation may be less reliable across diverse builds, but the impact is severe when successful.

How to fix it

Apply Microsoft security updates that address this Remote Desktop Client vulnerability across all affected Windows and Windows App installations. Because no exact fixed versions were provided in the input, use the latest applicable cumulative update or Microsoft-published security update for Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, and update Microsoft Windows App through the Microsoft Store, enterprise app management, winget, or equivalent software distribution tooling. Prioritize endpoints and servers used to initiate RDP connections, administrative workstations, helpdesk systems, jump hosts, and systems allowed to make outbound TCP/3389 connections. As compensating controls, restrict outbound RDP to approved destinations, block RDP to the public internet where possible, treat unsolicited .rdp files as unsafe, filter or quarantine .rdp attachments, enforce application control for remote access clients, and monitor or limit use of mstsc.exe, msrdc.exe, and Windows App in high-risk user groups.

How to confirm the fix worked

Confirm that affected Windows systems have received the relevant Microsoft security update through Windows Update, WSUS, Microsoft Configuration Manager, Intune, vulnerability management tooling, or endpoint inventory. Validate that Remote Desktop Client binaries such as mstsc.exe and Windows App or msrdc components are at Microsoft-patched versions for the installed OS and servicing channel. Verify that Windows 10, Windows 11, and Windows Server assets listed as affected are no longer reported vulnerable by authenticated vulnerability scans. Review egress controls to confirm outbound RDP is limited to approved destinations. Test that .rdp files from untrusted sources are blocked, warned, or inspected according to policy. For Microsoft Windows App, verify application update status separately from OS patch status because Store-delivered app components may not be remediated solely by OS patching.

Typical attack path

1. Identify organizations or users likely to initiate outbound RDP connections, such as administrators, helpdesk staff, contractors, or users of remote access workflows.
2. Set up or compromise an RDP server and configure it to deliver crafted protocol responses that exercise the vulnerable heap-handling path in the Remote Desktop Client.
3. Deliver a lure such as a malicious .rdp file, phishing message, support request, documentation link, or instruction to connect to the attacker-controlled RDP endpoint.
4. Wait for the target to open the RDP connection using a vulnerable Windows Remote Desktop Client or Windows App version.
5. Trigger heap corruption during RDP protocol negotiation or session handling.
6. Achieve code execution in the client process if exploitation succeeds.
7. Run post-exploitation actions such as credential theft, malware deployment, persistence, internal reconnaissance, or lateral movement.

How to detect it

Look for signs that users connected to suspicious or attacker-controlled RDP destinations and for instability or code execution around Remote Desktop Client processes. Relevant log sources include Windows Security logs, Sysmon or EDR process telemetry, firewall and proxy logs, DNS logs, Windows Error Reporting, Microsoft-Windows-TerminalServices-RDPClient/Operational, Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational, and endpoint network connection telemetry. Hunt for mstsc.exe, msrdc.exe, or Windows App launching from unusual parent processes such as email clients, browsers, archive utilities, scripting engines, or document readers. Correlate Remote Desktop Client process starts with outbound TCP/3389 connections to public, newly observed, rare, or geolocated-anomalous IP addresses. Investigate crashes of mstsc.exe or msrdc.exe, especially access violations or heap corruption events shortly after outbound RDP connections, as failed exploitation attempts may produce application faults. Review downloads and email attachments for .rdp files, especially those opened by users shortly before Remote Desktop Client execution. If suspicious activity is found, collect the .rdp file, process command lines, destination IPs and hostnames, memory dumps if available, Windows Error Reporting artifacts, EDR timeline, and any child processes spawned by the RDP client after the connection.

• mstsc.exe
• msrdc.exe
• .rdp
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Exception code: 0xc0000005
• Windows Error Reporting
• outbound tcp/3389
• DestinationPort=3389
• DestinationPort: 3389
• ParentImage=outlook.exe Image=mstsc.exe
• ParentImage=chrome.exe Image=mstsc.exe
• ParentImage=msedge.exe Image=mstsc.exe
• ParentImage=firefox.exe Image=mstsc.exe
• ParentImage=explorer.exe Image=mstsc.exe
• Image=mstsc.exe DestinationPort=3389
• Image=msrdc.exe DestinationPort=3389

What your security team should do

• Prioritize patching for systems and users that initiate RDP sessions, especially administrators, helpdesk personnel, jump hosts, and privileged access workstations.
• Inventory use of Remote Desktop Client, Windows App, mstsc.exe, and msrdc.exe across Windows endpoints and servers.
• Restrict outbound RDP traffic to approved internal or partner destinations and block direct RDP connections to the internet unless explicitly required.
• Harden email and web controls to block or detonate unsolicited .rdp files and links that launch Remote Desktop clients.
• Create detections for unexpected RDP client launches, outbound TCP/3389 connections to new or untrusted destinations, and crashes of mstsc.exe or msrdc.exe with access violation errors.
• Review recent Remote Desktop Client activity for suspicious connections, especially around phishing reports or anomalous helpdesk interactions.
• Educate support staff and administrators not to open RDP files or connect to remote desktop endpoints received through unsolicited messages.
• Because EPSS is currently low, no KEV listing exists, and exploit maturity is reported as none, track vendor and threat-intelligence updates but prioritize based on RDP exposure and privilege of affected users.