CVE-2026-48563

What it actually does

CVE-2026-48563 is a memory-corruption vulnerability in the Microsoft Remote Desktop Client affecting supported Windows client and server releases. The flaw is described as a heap-based buffer overflow and is categorized as a use-after-free class issue, meaning malformed Remote Desktop Protocol content can corrupt client-side process memory. Successful exploitation can allow unauthenticated remote code execution in the context of the user running the Remote Desktop Client, typically through a malicious or attacker-controlled RDP server that the victim connects to. The CVSS vector indicates network reachability, no attacker privileges required, high confidentiality/integrity/availability impact, high attack complexity, and required user interaction.

Why it matters to the business

If exploited, this vulnerability could let an attacker take control of a workstation or server user session after a user initiates an RDP connection to a malicious or compromised destination. Business consequences include endpoint compromise, credential theft, lateral movement, data exposure, malware deployment, and interruption of administrative operations that rely on Remote Desktop. The vulnerability is not currently listed in CISA KEV, is not marked as ransomware-used, has low EPSS probability, and has no public exploit maturity reported, but it affects widely deployed Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems, so organizations should still treat patching as important, especially for administrators and users who connect to external or third-party RDP endpoints.

How an attack unfolds

An attacker prepares or compromises an RDP server capable of sending malformed protocol data that triggers the vulnerable memory-handling path in the Windows Remote Desktop Client. The attacker then convinces a target user to connect to that server, for example through phishing, a fake support workflow, poisoned documentation, exposed remote-access instructions, or compromise of a legitimate RDP host. When the victim opens the connection using the vulnerable client, crafted server responses corrupt heap memory in the mstsc.exe process or related RDP client components. If exploitation succeeds, attacker-controlled code executes on the victim system under the privileges of the user who launched the RDP client. From there, the attacker may stage payloads, dump credentials, establish persistence, access files available to the user, or pivot to other systems. Because attack complexity is high and public exploitation is not currently reported, reliable exploitation may require precise heap shaping and target-version-specific behavior, but administrators are high-value targets because their RDP sessions often carry elevated credentials and network reachability.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-48563 for all affected Windows versions, including Windows 10 1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no specific fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the latest cumulative security update available for each supported release. Prioritize systems used for administration, systems that initiate RDP connections to untrusted networks, jump hosts, helpdesk workstations, privileged access workstations, and servers where administrators run the Remote Desktop Client. Until patching is complete, restrict outbound RDP to approved destinations, block or monitor TCP/3389 and UDP/3389 egress where not required, discourage users from opening untrusted .rdp files or connecting to unknown RDP hosts, and use application control or firewall policy to limit mstsc.exe execution for users who do not need it.

How to confirm the fix worked

Confirm that the relevant Windows cumulative security update released on or after the vendor fix date is installed on each affected system. Validate patch status through Windows Update history, enterprise patch-management reporting, PowerShell inventory of installed hotfixes/packages, or vulnerability scanning authenticated to the host. Verify that systems no longer appear vulnerable in scanner results for this CVE. For exposure validation, identify hosts where mstsc.exe is present and where users can initiate outbound RDP connections, then confirm outbound RDP is limited to approved destinations. Test representative patched systems by launching the Remote Desktop Client and confirming normal functionality. Where egress controls are used as mitigation, verify that unauthorized TCP/3389 and UDP/3389 outbound connections are blocked or alerted.

Typical attack path

1. Identify organizations or users likely to initiate outbound RDP connections, especially administrators, helpdesk staff, contractors, or users following remote-access instructions.
2. Prepare a malicious RDP service or compromise a legitimate RDP host that victims are expected to access.
3. Deliver a lure or workflow that causes the target to open the Windows Remote Desktop Client and connect to the attacker-controlled endpoint.
4. Send crafted RDP protocol responses that trigger heap memory corruption in the vulnerable client.
5. Achieve code execution in the context of the user running mstsc.exe.
6. Deploy follow-on tooling, steal credentials or session tokens, enumerate local and network resources, and attempt lateral movement or persistence.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry, Windows Event Logs, EDR process trees, crash reports, firewall/proxy logs, DNS logs, and remote-access logs for suspicious Remote Desktop Client activity. Focus on mstsc.exe connections to unknown, external, newly registered, or unusual destinations, particularly over TCP/3389 or UDP/3389. Look for mstsc.exe crashes followed shortly by suspicious child processes, payload execution, credential-access behavior, persistence creation, or outbound command-and-control traffic. Relevant Windows artifacts include Application Error events for mstsc.exe, Windows Error Reporting entries, TerminalServices RDP client operational logs, prefetch/amcache/shimcache evidence of mstsc.exe execution, recently opened .rdp files, browser/email downloads of .rdp files, and EDR memory-corruption or exploit-prevention alerts. Because no public exploit maturity, KEV listing, ransomware association, or named threat actor exploitation is currently reported, absence of a known signature does not prove safety; prioritize behavioral detection around abnormal RDP client connections and post-exploitation activity.

• mstsc.exe
• Faulting application name: mstsc.exe
• Faulting module name: mstscax.dll
• Faulting module name: RdpCoreTS.dll
• Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational
• Microsoft-Windows-TerminalServices-RDPClient/Operational
• Windows Error Reporting
• Application Error
• Event ID 1000
• Event ID 1001
• .rdp
• tcp/3389
• udp/3389
• mstsc.exe -> cmd.exe
• mstsc.exe -> powershell.exe
• mstsc.exe -> pwsh.exe
• mstsc.exe -> wscript.exe
• mstsc.exe -> cscript.exe
• mstsc.exe -> mshta.exe
• mstsc.exe -> rundll32.exe
• mstsc.exe -> regsvr32.exe
• mstsc.exe -> certutil.exe
• mstsc.exe -> bitsadmin.exe

What your security team should do

• Patch affected Windows endpoints and servers with the latest Microsoft cumulative security updates, prioritizing privileged user workstations, jump boxes, administrator endpoints, and systems that connect to external RDP services.
• Inventory outbound RDP usage and restrict mstsc.exe connections to approved destinations using host firewall, network firewall, proxy, or endpoint control policies.
• Search for recent RDP client crashes, unusual mstsc.exe child processes, and outbound RDP connections to unknown or newly observed IP addresses, especially after users opened unfamiliar .rdp files.
• Educate administrators and helpdesk personnel not to connect to untrusted RDP servers or open unexpected .rdp files, even when they appear to support remote troubleshooting workflows.
• Add detection rules for mstsc.exe spawning command shells, scripting engines, downloaders, or credential-access tools, as this is abnormal for normal Remote Desktop Client behavior.
• Monitor Microsoft advisories for fixed build details and any change in exploit maturity, KEV status, or active exploitation reporting.