CVE-2026-42993

What it actually does

This vulnerability is a heap-based buffer overflow in Microsoft Remote Desktop Client. A malicious or compromised RDP server can send specially crafted network data to the client during an RDP connection and corrupt heap memory inside the client process, potentially allowing arbitrary code execution in the context of the user running the Remote Desktop Client. The CVSS vector indicates network reachability, no attacker authentication required, high confidentiality/integrity/availability impact, but exploitation requires user interaction and has high attack complexity.

Why it matters to the business

Successful exploitation can allow an attacker to take control of a workstation or server administrator session after a user connects to a malicious RDP endpoint. This can lead to credential theft, malware installation, lateral movement, data access, and disruption of administrative operations. The current EPSS score is low and stable, there is no known KEV listing, no ransomware flag, and no public exploit maturity reported, but the affected product set is broad across supported Windows client and server versions, so patching should still be prioritized for systems and users that initiate RDP connections to third-party, untrusted, or internet-accessible hosts.

How an attack unfolds

An attacker sets up or compromises an RDP server and waits for a target to connect using the vulnerable Microsoft Remote Desktop Client. The lure may be delivered through phishing, helpdesk impersonation, malicious documentation containing an RDP connection target, or compromise of a legitimate remote access host. When the victim initiates the RDP connection, the malicious server returns crafted protocol data that triggers heap memory corruption in the client. If the attacker reliably controls the corrupted memory state, they can execute code on the victim system under the privileges of the user running the client. Post-exploitation activity may include spawning child processes from mstsc.exe, dropping payloads, harvesting credentials or tokens, establishing persistence, and using the compromised endpoint to reach additional internal systems.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for all affected Windows versions, including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025. If an exact fixed build is not available in asset tooling, use Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the applicable cumulative security update channel for the affected operating system. As interim risk reduction, restrict RDP client use to trusted destinations, block or monitor outbound RDP to the internet, prevent users from opening untrusted .rdp files, disable saved credentials where feasible, use privileged access workstations for administrative RDP activity, and enforce least privilege for users who initiate RDP sessions.

How to confirm the fix worked

Confirm that affected Windows systems have installed the relevant cumulative security update released for this vulnerability or a later superseding update. Validate via enterprise patch management, Windows Update history, installed hotfix inventory, or OS build/revision checks against Microsoft’s security update guidance. Confirm that high-risk users and administrative workstations are included in patch coverage. From a network-control perspective, verify that outbound RDP to untrusted destinations is blocked or logged. From an exposure perspective, search for frequent or unusual Remote Desktop Client usage, especially connections to external or newly observed RDP servers.

Typical attack path

1. Attacker prepares a malicious RDP server or compromises a legitimate RDP host used by targets.
2. Attacker convinces a user or administrator to initiate an RDP connection, or waits for routine administrative access to the compromised host.
3. The vulnerable Remote Desktop Client connects to the attacker-controlled RDP service over the network, typically TCP/3389.
4. The malicious server sends specially crafted RDP protocol data that triggers a heap-based buffer overflow in the client.
5. Attacker achieves code execution in the context of the user running the Remote Desktop Client.
6. Attacker runs payloads, steals credentials, establishes persistence, or pivots to additional systems.

How to detect it

To determine whether exploitation may have already occurred, correlate Remote Desktop Client activity with endpoint process, crash, network, and authentication telemetry. Review Windows Security logs, Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational, Microsoft-Windows-TerminalServices-RDPClient/Operational, endpoint detection telemetry, Sysmon process/network events, Windows Error Reporting, and firewall or proxy logs. Look for mstsc.exe connecting to unusual, newly observed, external, or user-supplied RDP servers, especially followed by a crash, access violation, unusual child process, script interpreter, credential access tool, archive utility, or outbound beacon. Investigate instances where mstsc.exe spawns cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, bitsadmin.exe, curl.exe, or other suspicious utilities. Review .rdp files received by email, downloaded from browsers, or opened from temporary directories. Since no public exploit indicators are provided, detection should focus on behavioral anomalies around RDP client connections and post-exploitation activity from the Remote Desktop Client process.

• mstsc.exe
• *.rdp
• tcp/3389
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• Faulting application name: mstsc.exe
• Exception code: 0xc0000005
• Windows Error Reporting
• mstsc.exe -> cmd.exe
• mstsc.exe -> powershell.exe
• mstsc.exe -> wscript.exe
• mstsc.exe -> cscript.exe
• mstsc.exe -> rundll32.exe
• mstsc.exe -> regsvr32.exe
• mstsc.exe -> mshta.exe
• mstsc.exe -> certutil.exe
• mstsc.exe -> bitsadmin.exe
• mstsc.exe -> curl.exe
• mstsc.exe -> wget.exe

What your security team should do

• Prioritize patching systems used by administrators, helpdesk staff, IT operators, developers, and users who commonly initiate RDP connections.
• Deploy the applicable Microsoft cumulative security update or later superseding update across all affected Windows client and server versions.
• Restrict outbound RDP traffic to approved destinations and alert on RDP connections to the internet or newly observed hosts.
• Educate users and administrators not to open unsolicited .rdp files or connect to untrusted remote desktop endpoints.
• Hunt for suspicious mstsc.exe activity, including crashes, unexpected child processes, connections to unknown RDP servers, and payload execution shortly after an RDP session starts.
• Review endpoint controls to ensure mstsc.exe cannot be abused to launch arbitrary post-exploitation tooling without detection.
• Because EPSS is currently low and no exploitation is known, treat this as important but risk-rank highest for RDP-heavy and privileged-access environments.