CVE-2026-47654

What it actually does

This vulnerability is a heap-based memory corruption flaw in the Microsoft Remote Desktop Client component on affected Windows Server platforms. An unauthenticated network attacker can trigger unsafe memory handling in the client by causing it to process malicious Remote Desktop Protocol content, potentially leading to arbitrary code execution in the context of the user running the Remote Desktop Client. The CVSS vector indicates network reachability, no privileges required, required user interaction, high attack complexity, and high confidentiality, integrity, and availability impact if exploitation succeeds.

Why it matters to the business

Successful exploitation could let an attacker take control of a server session used by an administrator or operator, steal credentials or sensitive data available to that user, deploy malware, pivot further into the environment, or disrupt server operations. Because exploitation requires a user to initiate or interact with a malicious or compromised RDP endpoint and no known exploited-in-the-wild or CISA KEV status is currently reported, immediate mass exploitation risk appears lower than for wormable server-side RDP flaws; however, the impact remains high because compromised administrative workstations or servers can become a strong foothold for lateral movement.

How an attack unfolds

An attacker prepares a malicious or compromised RDP service designed to send specially crafted protocol data to the Remote Desktop Client. The attacker then induces a user, administrator, or automation process on an affected Windows Server system to initiate an RDP connection to that endpoint, for example through phishing, social engineering, poisoned documentation, abuse of trusted infrastructure, or compromise of a legitimate RDP host. When the vulnerable client parses the malicious RDP content, heap memory corruption occurs. If the attacker successfully shapes memory despite the high-complexity conditions, code execution may be achieved under the privileges of the user running the client. After execution, the attacker may establish persistence, dump credentials, access files, or move laterally using the compromised account and host context.

How to fix it

Apply the relevant Microsoft security update or cumulative update for all affected Windows Server versions: Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so validate remediation against the official Microsoft Security Update Guide for this vulnerability and the installed operating system build. Where immediate patching is not possible, reduce exposure by restricting outbound RDP from servers to explicitly approved destinations, preventing administrators from connecting to untrusted RDP hosts, using privileged access workstations for administrative RDP activity, blocking RDP files from untrusted sources where feasible, and enforcing least privilege so successful client-side code execution has reduced impact.

How to confirm the fix worked

Confirm that each affected Windows Server system has installed the Microsoft cumulative or security update that addresses this Remote Desktop Client vulnerability. Use enterprise patch management, vulnerability scanning, Microsoft Security Update Guide applicability checks, and local verification commands such as Windows Update history, installed KB inventory, and OS build validation. Verify that outbound TCP/3389 and other approved RDP transport paths are restricted to trusted destinations where policy requires it. Test that users cannot initiate RDP sessions from affected servers to unapproved hosts. Run authenticated vulnerability scans after patching and confirm the finding is no longer reported for the Remote Desktop Client component.

Typical attack path

1. Identify organizations or users likely to initiate outbound RDP sessions from affected Windows Server systems.
2. Set up or compromise an RDP endpoint capable of delivering malicious protocol responses to the Remote Desktop Client.
3. Lure a user or administrator into connecting to the malicious RDP endpoint, or position the malicious endpoint where it appears trusted.
4. Trigger the heap-based buffer overflow when the client processes crafted RDP content.
5. Execute attacker-controlled code in the context of the user running the Remote Desktop Client.
6. Establish persistence, collect credentials or sensitive data, and attempt lateral movement from the compromised system.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry and Windows event logs for suspicious Remote Desktop Client behavior. Focus on systems where mstsc.exe was used to connect to unfamiliar or external RDP endpoints, especially shortly before process crashes, Windows Error Reporting events, or unexpected child processes. Relevant sources include EDR process creation logs, Windows Security logs, Sysmon logs, Windows Error Reporting, Application event logs, Microsoft-Windows-TerminalServices-ClientActiveXCore logs, firewall/proxy/netflow records for outbound RDP, and authentication logs for post-compromise activity. Investigate instances where mstsc.exe spawns command shells, scripting engines, download utilities, credential access tools, or persistence mechanisms. Also review outbound TCP/3389 sessions to unusual IP addresses, failed or repeated RDP client crashes, newly created services or scheduled tasks after an RDP client crash, and suspicious logons or lateral movement originating from the same host or user account.

• mstsc.exe
• Faulting application name: mstsc.exe
• Faulting module name: mstscax.dll
• Windows Error Reporting
• Microsoft-Windows-TerminalServices-ClientActiveXCore
• Outbound TCP 3389
• ParentImage: *\\mstsc.exe
• ParentProcessName=mstsc.exe
• ParentCommandLine=*mstsc.exe*
• Image: *\\cmd.exe ParentImage: *\\mstsc.exe
• Image: *\\powershell.exe ParentImage: *\\mstsc.exe
• Image: *\\wscript.exe ParentImage: *\\mstsc.exe
• Image: *\\cscript.exe ParentImage: *\\mstsc.exe
• Image: *\\rundll32.exe ParentImage: *\\mstsc.exe
• Image: *\\regsvr32.exe ParentImage: *\\mstsc.exe
• Image: *\\mshta.exe ParentImage: *\\mstsc.exe
• Event ID 1000 mstsc.exe
• Event ID 1001 mstsc.exe
• *.rdp

What your security team should do

• Prioritize patching systems used for administration, jump-host functions, remote support, or any workflows that initiate outbound RDP sessions.
• Inventory affected Windows Server 2016, 2019, 2022, and 2025 systems and validate whether the vulnerable Remote Desktop Client component is present and used.
• Restrict outbound RDP from servers to approved management destinations and alert on RDP connections to internet or untrusted addresses.
• Warn administrators and operators not to open unsolicited .rdp files or connect to untrusted RDP endpoints until remediation is complete.
• Monitor for crashes or abnormal child processes spawned by the Remote Desktop Client, especially around outbound RDP sessions.
• Because there is currently no KEV listing, no ransomware association, low EPSS, and no reported exploit maturity in the provided data, treat this as high-impact but not yet active-exploitation-driven; continue monitoring vendor advisories and threat intelligence for changes.