CVE-2026-47289

What it actually does

This is a heap-based buffer overflow in the Microsoft Remote Desktop Client components used by Windows and the Windows App. A malicious or compromised RDP server can send crafted protocol data that is mishandled by the client, corrupting heap memory and potentially allowing code execution in the context of the user running the Remote Desktop Client. The CVSS vector indicates network reachability, low attack complexity, no attacker authentication requirement, and required user interaction, meaning exploitation generally depends on convincing a user to initiate or accept an RDP connection to attacker-controlled infrastructure.

Why it matters to the business

Successful exploitation can compromise a workstation or server used to initiate remote desktop sessions, allowing theft of credentials, deployment of malware, lateral movement, or disruption of administrative workflows. Because Remote Desktop Client software is present across many Windows desktop and server versions, exposure may be broad in organizations that use RDP for administration, remote work, vendor access, jump hosts, or cloud management. Although this issue is not currently listed in CISA KEV and the provided exploit maturity is none, the high impact and ease of network delivery make timely patching important, especially for privileged administrator workstations and systems used to connect to untrusted or third-party RDP endpoints.

How an attack unfolds

An attacker prepares a malicious RDP service or compromises an existing RDP endpoint and configures it to deliver malformed protocol responses during client negotiation or session setup. The attacker then induces a target user to connect, for example through phishing, a malicious .rdp file, a fake support workflow, poisoned documentation, or redirection to an attacker-controlled remote desktop host. When the vulnerable Remote Desktop Client processes the crafted server response, heap memory is corrupted. If the attacker can reliably shape memory, the crash condition may be turned into arbitrary code execution under the victim user's privileges. Post-exploitation activity would likely focus on credential theft from the interactive user, token abuse, persistence, staging of remote access tools, and lateral movement from the compromised client system.

How to fix it

Apply the Microsoft security updates that address this vulnerability for all affected Windows and Windows App versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use the applicable Microsoft Security Update Guide entry and current cumulative updates for each supported OS release. Prioritize systems used for administration, jump boxes, privileged workstations, help desk systems, and devices that connect to external or third-party RDP servers. Where immediate patching is not possible, reduce exposure by blocking outbound RDP to untrusted destinations, restricting use of .rdp files from email/web downloads, disabling or limiting Remote Desktop Client use on high-risk systems, enforcing application control for mstsc.exe and Windows App RDP components where feasible, and educating users not to connect to unknown RDP hosts.

How to confirm the fix worked

Confirm that all affected endpoints have installed the relevant Microsoft cumulative/security update released for this issue or a later superseding update. Validate OS build and patch status using centralized endpoint management, vulnerability scanning, or authenticated checks against Windows update inventory. Confirm that vulnerable Remote Desktop Client binaries have been updated by comparing file versions against Microsoft advisory guidance. Test compensating controls by verifying that outbound TCP/UDP 3389 and other approved RDP egress paths are restricted to authorized destinations. Review software inventory for Microsoft Windows App installations and ensure they are updated through the appropriate Microsoft Store or enterprise deployment channel. Where possible, perform a controlled connection test using patched clients to approved RDP servers and confirm no vulnerable versions remain in active use.

Typical attack path

1. Identify users likely to initiate Remote Desktop connections, such as administrators, help desk staff, developers, or remote support personnel.
2. Stand up or compromise an RDP server capable of sending crafted protocol data to vulnerable clients.
3. Deliver a lure that causes the target to open a malicious .rdp file or manually connect to the attacker-controlled RDP endpoint.
4. Trigger the heap overflow during RDP client negotiation or session handling.
5. Execute code in the context of the user running the Remote Desktop Client if exploitation is successful.
6. Establish persistence or launch a second-stage payload on the client system.
7. Harvest credentials, session tokens, browser data, or remote access configuration data.
8. Use the compromised endpoint as a foothold for lateral movement or further intrusion.

How to detect it

To determine whether exploitation may have already occurred, correlate Remote Desktop Client activity with crashes, unusual network destinations, and post-crash process execution. Review Windows Event Logs for Application Error and Windows Error Reporting events involving mstsc.exe, msrdc.exe, RemoteDesktop.exe, or Windows App remote desktop components. Check EDR/Sysmon for Remote Desktop Client processes spawning suspicious children such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or unknown executables. Review firewall, proxy, VPN, DNS, and NetFlow logs for outbound RDP traffic to unfamiliar external IP addresses, especially immediately before a client crash. Search endpoint artifacts for recently opened .rdp files, browser downloads, email attachments, and command-line invocations of mstsc.exe with nonstandard connection files. Investigate memory dumps, WER reports, and EDR crash telemetry for heap corruption or access violations in Remote Desktop Client modules. Because no public exploit indicators were provided, detection should focus on behavioral evidence: unexpected RDP destinations, crashes in RDP client processes, suspicious child processes, payload staging, persistence changes, and credential-access activity after RDP client use.

• mstsc.exe
• msrdc.exe
• RemoteDesktop.exe
• .rdp
• Event ID 1000
• Event ID 1001
• Application Error
• Windows Error Reporting
• Faulting application name: mstsc.exe
• Faulting application name: msrdc.exe
• Faulting application name: RemoteDesktop.exe
• Exception code: 0xc0000005
• cmd.exe spawned by mstsc.exe
• powershell.exe spawned by mstsc.exe
• wscript.exe spawned by mstsc.exe
• cscript.exe spawned by mstsc.exe
• mshta.exe spawned by mstsc.exe
• rundll32.exe spawned by mstsc.exe
• regsvr32.exe spawned by mstsc.exe
• certutil.exe spawned by mstsc.exe
• bitsadmin.exe spawned by mstsc.exe
• curl.exe spawned by mstsc.exe
• outbound TCP 3389
• outbound UDP 3389
• %USERPROFILE%\Downloads\*.rdp
• %APPDATA%\Microsoft\Windows\Recent\*.rdp
• HKCU\Software\Microsoft\Terminal Server Client\Servers

What your security team should do

• Patch affected Windows and Windows App clients, prioritizing privileged workstations, jump hosts, administrator endpoints, and systems that initiate RDP connections to external networks.
• Temporarily restrict outbound RDP connections to only approved destinations until patch coverage is verified.
• Hunt for suspicious Remote Desktop Client crashes, especially mstsc.exe or Windows App RDP component crashes occurring immediately after connections to unfamiliar IP addresses.
• Monitor for suspicious child processes spawned by Remote Desktop Client processes, such as command shells, scripting engines, download utilities, or remote access tools.
• Block or quarantine unsolicited .rdp files delivered by email, collaboration platforms, or web downloads.
• Review firewall, proxy, DNS, and EDR telemetry for users connecting to new or unusual RDP endpoints around the time of crashes or alerts.
• Ensure administrators use hardened, patched privileged access workstations for RDP activity.
• Update user awareness guidance to warn against opening unexpected .rdp files or connecting to unknown remote desktop hosts.