CVE-2026-47653

What it actually does

This vulnerability is a memory-corruption flaw in the Microsoft Remote Desktop Client. A malicious or compromised RDP server can trigger a heap-based buffer overflow or similar object-lifetime corruption condition in the client when a user initiates a Remote Desktop connection. Successful exploitation can allow code execution in the context of the logged-on user running the RDP client, with potential access to that user's files, credentials, network resources, and local session. The CVSS vector indicates network reachability, low attack complexity, no attacker authentication requirement, but required user interaction because the victim must connect to attacker-controlled or compromised RDP infrastructure.

Why it matters to the business

If exploited, this flaw could let an attacker compromise workstations or administrative systems used to connect to remote desktops, potentially leading to credential theft, malware installation, lateral movement, and disruption of administrative operations. The risk is highest for users who connect to external, vendor-managed, lab, cloud, or otherwise untrusted RDP servers. It is not currently listed in CISA KEV, has no known public exploit maturity in the provided data, and has a low EPSS score, but the high severity and broad Windows client/server product coverage make timely patching important.

How an attack unfolds

An attacker first prepares or compromises an RDP server that can deliver malformed protocol data to connecting clients. The attacker then persuades a target to initiate a Remote Desktop session to that server, for example through phishing, a fake support workflow, poisoned documentation, or by compromising a legitimate RDP host the victim already uses. During connection negotiation or session setup, the malicious server sends crafted data that corrupts heap memory inside the Remote Desktop Client process. If the attacker reliably controls execution flow, their payload runs under the victim user's privileges. From there, the attacker may stage malware, steal credentials and session material, access files and mapped resources available to the user, and attempt privilege escalation or lateral movement.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, or enterprise patch management. Because no exact fixed build numbers were provided, validate remediation against Microsoft's official advisory for this vulnerability and confirm that supported releases of Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 have received the June 2026 or later cumulative security update that addresses the Remote Desktop Client flaw. Where immediate patching is not possible, reduce exposure by blocking outbound RDP to untrusted destinations, restricting RDP usage to approved hosts through firewall or proxy controls, preventing users from opening .rdp files from email or the web, and using application control or policy to limit who can run Remote Desktop Client. Avoid connecting from privileged administrator workstations to untrusted or unmanaged RDP servers.

How to confirm the fix worked

Confirm that affected systems have installed the Microsoft cumulative update that supersedes the vulnerable Remote Desktop Client version. Validate through enterprise patch inventory, Windows Update history, installed hotfix records, and file-version checks for Remote Desktop Client components such as mstsc.exe and related RDP libraries, comparing them to Microsoft's advisory or update catalog baselines. Test that controls prevent outbound RDP connections to unauthorized destinations. Review whether users can launch externally supplied .rdp files and whether endpoint protection detects suspicious child processes or crashes from mstsc.exe. A practical exposure check is to inventory systems where mstsc.exe is present and where outbound TCP/3389 or alternative RDP ports are permitted to internet or untrusted network ranges.

Typical attack path

1. Attacker sets up or compromises an RDP server reachable by the victim.
2. Attacker lures the victim into connecting with Microsoft Remote Desktop Client, or waits for routine connections to a compromised RDP endpoint.
3. The client initiates an RDP session to the malicious server.
4. The malicious server sends crafted RDP protocol responses that trigger heap memory corruption in the client.
5. The Remote Desktop Client crashes or, with reliable exploitation, executes attacker-controlled code as the logged-on user.
6. Attacker establishes persistence or deploys follow-on tooling on the victim system.
7. Attacker steals credentials, accesses user data, or pivots to additional systems using the victim user's permissions.

How to detect it

To determine whether this was already exploited, review endpoint, proxy, firewall, DNS, and Windows event logs for unusual Remote Desktop Client activity, especially connections from endpoints to unfamiliar, newly registered, external, or vendor-controlled RDP hosts. Focus on systems where users opened .rdp files, where mstsc.exe crashed, or where mstsc.exe was followed by unusual process creation. Useful Windows log sources include Security event logs for process creation if enabled, Sysmon process and network telemetry, Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational, Microsoft-Windows-TerminalServices-RDPClient/Operational, Windows Error Reporting, Application logs, EDR telemetry, firewall egress logs, and DNS logs. Hunt for mstsc.exe initiating outbound connections to unexpected IPs or ports, followed closely by crashes, new executable drops, credential access behavior, persistence creation, PowerShell/cmd execution, or outbound command-and-control traffic. Because no public exploit indicators or threat-actor-specific infrastructure are provided, detection should be behavior-based rather than relying on fixed hashes or domains.

• mstsc.exe
• Faulting application name: mstsc.exe
• Remote Desktop Connection
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• Windows Error Reporting
• Application Error
• tcp/3389
• .rdp
• cmd.exe spawned by mstsc.exe
• powershell.exe spawned by mstsc.exe
• wscript.exe spawned by mstsc.exe
• cscript.exe spawned by mstsc.exe
• rundll32.exe spawned by mstsc.exe
• regsvr32.exe spawned by mstsc.exe
• mshta.exe spawned by mstsc.exe

What your security team should do

• Prioritize patching systems used for administration, help desk, third-party access, cloud management, engineering, and any users who regularly initiate RDP sessions.
• Deploy the Microsoft security update that fixes this Remote Desktop Client vulnerability across supported Windows client and server versions.
• Restrict outbound RDP from endpoints to approved internal or managed destinations only; block internet-bound RDP where not explicitly required.
• Warn users and administrators not to open unsolicited .rdp files or connect to untrusted RDP servers.
• Monitor for mstsc.exe crashes, suspicious child processes, and RDP connections to new or external destinations.
• Harden privileged access workflows so administrators do not use high-value credentials from general-purpose workstations when connecting over RDP.
• Use endpoint detection and response rules to alert when mstsc.exe spawns scripting engines, command shells, download utilities, or unknown executables.
• If suspicious activity is found, isolate the endpoint, collect memory and triage artifacts, review credential exposure, and rotate affected credentials.