CVE-2026-44801

What it actually does

This vulnerability is a memory-corruption flaw in Microsoft Remote Desktop Client and related Windows App remote desktop components. A specially crafted Remote Desktop Protocol interaction can trigger a heap-based buffer overflow or similar unsafe memory access condition in the client process. If exploitation succeeds, an unauthenticated remote attacker can execute arbitrary code in the security context of the user running the Remote Desktop client. The CVSS vector indicates exploitation is network reachable but requires user interaction and high attack complexity, meaning the attacker typically needs to convince a user to connect to or interact with a malicious or compromised RDP endpoint and then successfully shape protocol data to gain code execution.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a workstation or server administrator session used to initiate Remote Desktop connections, potentially leading to credential theft, lateral movement, data access, malware deployment, or compromise of privileged administration workflows. The affected product set spans many supported Windows desktop and server versions as well as Microsoft Remote Desktop Client and Windows App, so exposure may be broad in organizations that rely on RDP for administration or remote access. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity in the provided data, but it still warrants timely patching because client-side remote-code-execution flaws can become more dangerous if weaponized in phishing or malicious infrastructure campaigns.

How an attack unfolds

An attacker prepares a malicious or compromised Remote Desktop service capable of sending crafted RDP responses to a connecting client. The attacker then persuades a target user to initiate a Remote Desktop connection, for example through social engineering, a malicious connection file, a fake support workflow, or redirection to attacker-controlled infrastructure. During protocol negotiation or session handling, the malicious server returns data designed to corrupt heap memory in the vulnerable Remote Desktop client. With a reliable exploit, the attacker pivots from memory corruption to code execution inside the client process, such as mstsc.exe, msrdc.exe, or the Windows App remote desktop component. The resulting code runs with the privileges of the logged-in user, enabling payload execution, credential theft, persistence attempts, or follow-on access to systems reachable from that endpoint.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows desktop, Windows Server, Microsoft Remote Desktop Client, and Windows App installations as soon as updates are available through Windows Update, Microsoft Update Catalog, WSUS, Intune, or other enterprise patch tooling. Because no exact fixed versions were provided, validate remediation against Microsoft’s official advisory and current monthly cumulative update guidance for each affected platform. Prioritize systems used by administrators, help desk staff, remote support teams, and users who regularly connect to third-party or unmanaged RDP endpoints. Where immediate patching is not possible, reduce exposure by restricting outbound RDP connections to trusted destinations, blocking untrusted .rdp files and unsolicited Remote Desktop connection workflows, disabling or limiting RDP client use where not required, and enforcing least privilege for users who initiate remote sessions.

How to confirm the fix worked

Confirm that affected endpoints have installed the applicable Microsoft cumulative security update or updated Remote Desktop Client / Windows App package that addresses this vulnerability. Use enterprise patch inventory, Windows Update compliance reporting, Microsoft Defender Vulnerability Management, Intune, WSUS, SCCM, or equivalent tooling to verify update status across Windows 10, Windows 11, Windows Server, Microsoft Remote Desktop Client, and Windows App deployments. Validate that mstsc.exe, msrdc.exe, and Windows App remote desktop components are no longer on vulnerable builds according to Microsoft’s advisory. Where compensating controls are used, test that outbound RDP is limited to approved destinations and that untrusted RDP connection files are blocked or warned on. Review representative endpoints for recent Remote Desktop client crashes or suspicious child processes to ensure there is no sign of attempted exploitation before declaring the issue fully remediated.

Typical attack path

1. Identify users or administrators likely to initiate outbound Remote Desktop connections.
2. Stand up or compromise an RDP endpoint capable of delivering crafted protocol responses.
3. Deliver a lure such as a remote support request, connection instructions, link, or RDP file that causes the user to connect.
4. Trigger the vulnerable client-side parsing or session-handling path during the RDP interaction.
5. Exploit heap memory corruption to gain code execution in the Remote Desktop client process.
6. Run post-exploitation actions such as credential collection, payload staging, persistence, or lateral movement from the compromised endpoint.

How to detect it

To determine whether exploitation may have already occurred, review endpoint detection telemetry, Windows Security logs, Sysmon logs, Microsoft Defender for Endpoint advanced hunting data, application crash logs, firewall/proxy logs, and RDP client connection history. Focus on sequences where Remote Desktop client processes connect to unusual or internet-facing destinations and are followed by crashes, abnormal child processes, script execution, credential-access behavior, or new persistence. Look for mstsc.exe, msrdc.exe, or Windows App remote desktop components spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe, mshta.exe, certutil.exe, curl.exe, or unknown binaries. Review Windows Application event logs for Remote Desktop client faults with access-violation style exceptions, especially exception code 0xc0000005, around the time of outbound RDP connections. Network detections should flag client-initiated TCP/3389 connections to newly observed, untrusted, or external hosts, particularly when preceded by opening a downloaded .rdp file. Because no public exploit indicators or threat actors are provided, detection should be behavior-based rather than relying on fixed hashes or domains.

• mstsc.exe
• msrdc.exe
• WindowsApp.exe
• %SystemRoot%\System32\mstsc.exe
• %LocalAppData%\Apps\Remote Desktop\msrdc.exe
• *.rdp
• ParentImage=*\mstsc.exe
• ParentImage=*\msrdc.exe
• ParentImage=*\WindowsApp.exe
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Exception code: 0xc0000005
• Application Error
• TCP/3389
• cmd.exe /c
• powershell.exe -enc
• rundll32.exe
• regsvr32.exe
• mshta.exe
• certutil.exe -urlcache

What your security team should do

• Prioritize patching endpoints used for administration, IT support, privileged access, and frequent RDP connectivity.
• Inventory use of Microsoft Remote Desktop Client, Windows App, and built-in Remote Desktop clients across all supported Windows desktop and server versions.
• Restrict outbound RDP traffic to approved hosts and networks; alert on RDP client connections to internet or newly observed destinations.
• Block or quarantine unsolicited .rdp files delivered by email, chat, web downloads, or collaboration platforms where business processes allow.
• Hunt for suspicious process creation where mstsc.exe, msrdc.exe, or Windows App remote desktop components spawn shells, scripting engines, downloaders, or credential-access tools.
• Review crash telemetry for Remote Desktop client access violations, especially when correlated with external RDP destinations.
• Educate administrators and support personnel not to connect to untrusted RDP endpoints or open unexpected RDP connection files.
• Monitor Microsoft guidance for exact fixed build information, exploitability updates, and any future KEV or active exploitation designation.