CVE-2026-44799

What it actually does

This is a client-side heap-based buffer overflow in Microsoft Remote Desktop Client and related Windows remote desktop applications. A remote, unauthenticated attacker can trigger memory corruption by causing a vulnerable client to process specially crafted Remote Desktop Protocol content, most plausibly by enticing a user to connect to a malicious RDP server or open a malicious RDP connection file. Successful exploitation can allow arbitrary code execution in the context of the user running the Remote Desktop client, with potential access to that user’s files, credentials, network resources, and local session data. The CVSS vector indicates network reachability, no attacker authentication requirement, required user interaction, high attack complexity, and high confidentiality, integrity, and availability impact.

Why it matters to the business

If exploited, this vulnerability could let an attacker compromise workstations or administrator jump boxes through remote desktop workflows, leading to credential theft, malware execution, lateral movement, data access, and disruption of administrative operations. The risk is highest for users who connect to external, vendor, lab, partner, or internet-hosted RDP systems, and for administrators using privileged accounts from affected Windows clients. The issue is not currently listed in CISA KEV, is not marked as ransomware-used, has low EPSS, and has no reported mature public exploit in the supplied data, but the impact of successful exploitation remains severe because it can produce full code execution from a common remote access client.

How an attack unfolds

An attacker prepares a malicious RDP endpoint or crafted RDP connection workflow designed to trigger a heap overflow in the vulnerable Remote Desktop Client. The attacker then persuades a victim to initiate a connection, for example through a phishing message, support pretext, malicious .rdp file, poisoned documentation, or a link to a remote desktop resource. When the affected client negotiates or processes the malicious server response or connection content, the heap corruption condition is triggered. With reliable exploitation, the attacker gains code execution as the current user on the client system. From there, the attacker may launch payloads, steal cached credentials or tokens, access files available to the user, establish persistence, or use the compromised endpoint as a foothold for lateral movement. Because exploitation requires user interaction and is high complexity, failed exploitation may appear as Remote Desktop Client crashes, Windows Error Reporting events, or abnormal child processes spawned by the RDP client.

How to fix it

Apply the Microsoft security update or latest cumulative update for all affected Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025 where Remote Desktop Client components are present. Update Microsoft Remote Desktop Client and Microsoft Windows App through the official Microsoft Store or enterprise software distribution channel. Because no exact fixed versions were supplied, use Microsoft’s authoritative security update guidance for this CVE and verify that all supported affected product branches have received the relevant June 2026 or later security updates. Where immediate patching is not possible, reduce exposure by blocking outbound RDP connections to untrusted networks, restricting use of .rdp files from email or web downloads, allowing RDP only to approved destinations, disabling or limiting Remote Desktop Client use on high-privilege administrative workstations, and educating users not to connect to unsolicited remote desktop endpoints. Consider application control rules to prevent Remote Desktop clients from launching script interpreters or command shells.

How to confirm the fix worked

Confirm that endpoints have installed the Microsoft update that addresses this vulnerability through Windows Update, WSUS, Microsoft Configuration Manager, Intune, or other patch management tooling. Verify Microsoft Remote Desktop Client and Windows App are updated from trusted Microsoft channels. Confirm affected systems are no longer running unpatched Remote Desktop Client binaries by checking installed update history, OS build level, package inventory, and file versions against Microsoft’s official advisory. Validate compensating controls by testing that outbound RDP traffic to unapproved destinations is blocked and that downloaded .rdp files are handled according to policy. For exposure assessment, inventory endpoints and servers with Remote Desktop Client, Windows App, mstsc.exe, or Microsoft Remote Desktop packages installed, especially privileged access workstations and systems used for third-party remote access.

Typical attack path

1. Identify organizations or users likely to use Remote Desktop Client, Windows App, or RDP files for remote access.
2. Host or control a malicious RDP server, gateway-like lure, or crafted RDP connection file that triggers the heap overflow.
3. Deliver the lure through phishing, chat, documentation, ticketing systems, fake support instructions, or a compromised website.
4. Convince the victim to open the RDP file or connect to the attacker-controlled RDP endpoint.
5. Exploit the client-side heap overflow during RDP negotiation or content processing.
6. Execute attacker-controlled code in the context of the logged-on user running the client.
7. Run follow-on commands, drop malware, steal credentials, enumerate accessible resources, or pivot to other systems.

How to detect it

Look for evidence that a user connected to an attacker-controlled or unusual RDP endpoint shortly before a Remote Desktop Client crash, abnormal process creation, or malware execution. Useful log sources include EDR process telemetry, Sysmon, Windows Security logs, Microsoft-Windows-TerminalServices-ClientActiveXCore logs, Microsoft-Windows-TerminalServices-RDPClient logs where available, Windows Application event logs, Windows Error Reporting, firewall/proxy/DNS logs, email security logs, browser download history, and endpoint forensic artifacts such as Prefetch, AmCache, ShimCache, SRUM, Jump Lists, and recent .rdp files. Hunt for mstsc.exe, msrdc.exe, or Windows App remote desktop components making outbound connections to untrusted IPs or domains, followed by crashes with access violation errors, creation of dump files, or child processes such as powershell.exe, cmd.exe, rundll32.exe, regsvr32.exe, mshta.exe, wscript.exe, or cscript.exe. Also review downloaded or emailed .rdp files, especially those originating from external senders, shortened links, newly registered domains, or unexpected support workflows. Because no public exploit maturity or known threat actor use was supplied, detections should focus on behavioral signs rather than fixed exploit strings.

• mstsc.exe
• msrdc.exe
• msrdcw.exe
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Faulting application name: msrdcw.exe
• Exception code: 0xc0000005
• Windows Error Reporting
• Event ID 1000
• Event ID 1001
• Microsoft-Windows-TerminalServices-ClientActiveXCore
• Microsoft-Windows-TerminalServices-RDPClient
• *.rdp
• mstsc.exe -> powershell.exe
• mstsc.exe -> cmd.exe
• mstsc.exe -> rundll32.exe
• mstsc.exe -> regsvr32.exe
• mstsc.exe -> mshta.exe
• mstsc.exe -> wscript.exe
• mstsc.exe -> cscript.exe
• msrdc.exe -> powershell.exe
• msrdc.exe -> cmd.exe
• msrdc.exe -> rundll32.exe
• msrdc.exe -> regsvr32.exe
• msrdc.exe -> mshta.exe
• msrdc.exe -> wscript.exe
• msrdc.exe -> cscript.exe
• %LOCALAPPDATA%\CrashDumps\mstsc.exe.*.dmp
• %LOCALAPPDATA%\CrashDumps\msrdc.exe.*.dmp
• %LOCALAPPDATA%\Microsoft\Windows\INetCache\*.rdp
• %USERPROFILE%\Downloads\*.rdp
• %APPDATA%\Microsoft\Windows\Recent\*.rdp

What your security team should do

• Prioritize patching endpoints used by administrators, help desk staff, vendors, developers, and users who connect to external or less-trusted RDP systems.
• Deploy the Microsoft security update or latest cumulative update for all affected Windows versions and update Microsoft Remote Desktop Client / Windows App from official Microsoft channels.
• Restrict outbound RDP traffic to approved destinations only, especially from workstations and administrator systems.
• Block or quarantine unsolicited .rdp files from email, collaboration platforms, and web downloads where business processes allow.
• Create detections for Remote Desktop Client crashes, Windows Error Reporting events, and suspicious child processes launched by mstsc.exe, msrdc.exe, or Windows App remote desktop components.
• Review recent RDP client usage for connections to unusual external IP addresses, newly observed domains, or destinations associated with phishing reports.
• Apply endpoint controls that prevent RDP client processes from spawning powershell.exe, cmd.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, or other living-off-the-land execution utilities.
• If suspicious exploitation is suspected, collect memory, Windows Error Reporting artifacts, RDP connection history, browser/download history, email artifacts, prefetch, AmCache, ShimCache, and EDR telemetry from affected endpoints.