CVE-2026-50474

What it actually does

This vulnerability is a use-after-free memory corruption flaw in Microsoft Remote Desktop Client. A malicious or attacker-controlled RDP endpoint can cause the client to reference freed memory and potentially execute arbitrary code on the system running the RDP client. Because exploitation occurs over the network but requires user interaction, the most likely trigger is a user initiating an RDP connection to a hostile server or opening a crafted Remote Desktop connection file. Successful exploitation can provide code execution in the context of the logged-in user, enabling data access, malware execution, credential theft, and lateral movement depending on local privileges and endpoint controls.

Why it matters to the business

If exploited, this flaw can turn a routine remote desktop connection into endpoint compromise. Organizations that allow administrators, helpdesk staff, vendors, or users to initiate RDP sessions to external or unmanaged systems face elevated risk because those workstations often have access to sensitive internal resources. Compromise of IT or administrative workstations can lead to operational disruption, credential exposure, unauthorized access to servers, and follow-on intrusion activity. The vulnerability affects many supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions, so remediation may require broad patch deployment across workstation and server fleets.

How an attack unfolds

An attacker prepares a malicious RDP server or crafted connection workflow designed to exercise the vulnerable code path in the Microsoft Remote Desktop Client. The attacker then persuades a target to connect, for example through phishing, fake support instructions, malicious documentation, social engineering, or compromise of a legitimate host that users already access by RDP. When the victim's Remote Desktop Client connects, the server sends specially crafted protocol data that triggers a use-after-free condition in the client process. If the attacker achieves reliable memory corruption control, code executes on the victim machine under the victim's user context. The attacker may then launch payloads, establish persistence, steal cached credentials or tokens, enumerate accessible network resources, and move laterally using the victim's privileges. No public exploit maturity is currently reported in the supplied data and the issue is not listed in CISA KEV, but the network-reachable nature, low attack complexity, and broad Windows exposure make it important to patch promptly.

How to fix it

Apply the Microsoft security update that fixes CVE-2026-50474 to all affected Windows systems, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the applicable July 2026 or later cumulative/security updates for each OS release. Until patching is complete, reduce exposure by restricting outbound RDP to trusted destinations, blocking RDP connections to the internet where feasible, warning users not to open unsolicited .rdp files or connect to unknown RDP hosts, and limiting RDP client use from high-privilege administrative workstations. Use least privilege and endpoint protection controls to reduce impact if exploitation occurs.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft security update that supersedes or includes the fix for this vulnerability. Validate through Windows Update history, enterprise patch management compliance reports, PowerShell-based hotfix/build inventory, or vulnerability scanning authenticated to the host. Confirm that Remote Desktop Client binaries have been updated to the expected patched versions for the installed Windows release. Test mitigation by verifying outbound TCP/3389 and other permitted RDP paths are limited to approved destinations. Confirm that users cannot open unsolicited .rdp files from email or web downloads where application control, email filtering, or attachment controls are in place. Run an authenticated vulnerability scan after patching to ensure the CVE is no longer reported.

Typical attack path

1. Attacker sets up or compromises an RDP server under their control.
2. Attacker lures a user into initiating an RDP session to the malicious endpoint or opening a crafted Remote Desktop connection file.
3. Victim launches Microsoft Remote Desktop Client, commonly mstsc.exe, and connects to the attacker-controlled server.
4. Malicious RDP protocol responses trigger a use-after-free condition in the client.
5. Attacker gains code execution in the context of the victim user.
6. Attacker runs post-exploitation commands or payloads, such as credential theft, persistence setup, reconnaissance, or lateral movement.

How to detect it

To determine whether exploitation may already have occurred, review endpoint, EDR, Windows Event Log, proxy, DNS, firewall, and VPN telemetry for suspicious Remote Desktop Client activity. Focus on systems where mstsc.exe connected to unknown or external RDP endpoints, especially followed by process crashes, WerFault activity, new child processes, unusual command execution, credential access, or persistence changes. Investigate Windows Application logs and Windows Error Reporting events for mstsc.exe crashes around the time of outbound RDP sessions. Review Security logs, Sysmon, and EDR process telemetry for mstsc.exe spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or other utilities not normally launched by the RDP client. Review firewall and network logs for outbound TCP/3389 from user workstations to internet addresses or newly observed destinations. Examine downloaded files, email attachments, browser caches, and recent-file artifacts for .rdp files that reference untrusted hosts. Because no specific public exploit indicators were provided, detection should emphasize behavioral evidence around mstsc.exe, anomalous outbound RDP, memory-corruption crashes, and post-exploitation activity.

• mstsc.exe
• Microsoft Remote Desktop Connection
• Remote Desktop Connection
• *.rdp
• TCP/3389
• WerFault.exe
• Faulting application name: mstsc.exe
• Application Error
• Windows Error Reporting
• mstsc.exe cmd.exe
• mstsc.exe powershell.exe
• mstsc.exe pwsh.exe
• mstsc.exe wscript.exe
• mstsc.exe cscript.exe
• mstsc.exe mshta.exe
• mstsc.exe rundll32.exe
• mstsc.exe regsvr32.exe
• mstsc.exe certutil.exe
• mstsc.exe bitsadmin.exe
• mstsc.exe curl.exe
• mstsc.exe wget.exe
• Event ID 1000
• Event ID 1001
• Event ID 4688
• Event ID 1

What your security team should do

• Prioritize patching workstations and jump hosts used by administrators, helpdesk personnel, engineers, vendors, and users who frequently initiate RDP connections.
• Deploy the relevant Microsoft cumulative/security updates across all affected Windows client and server versions; track exceptions until closed.
• Temporarily restrict outbound RDP connections to known trusted hosts and block internet-bound RDP from user workstations where operationally possible.
• Hunt for suspicious mstsc.exe activity, especially crashes, unexpected child processes, connections to unfamiliar external IP addresses, or execution shortly after opening downloaded .rdp files.
• Educate users and support teams not to connect to unknown RDP servers or open unsolicited Remote Desktop connection files.
• Enable or tune endpoint detection rules for mstsc.exe spawning shells, script interpreters, credential-access tools, or network utilities.
• Review administrative workstation hardening, including least privilege, credential guard, application control, and separation of administrative and browsing/email activity.
• Monitor threat intelligence for any change in exploit maturity, public proof-of-concept availability, ransomware use, or CISA KEV inclusion.