Executive brief
A vulnerability in the Microsoft Remote Desktop Client allows a remote attacker to execute malicious code on a user's computer. This occurs when a user connects to a malicious or compromised server, potentially leading to a full system takeover and theft of sensitive data. Organizations should ensure all remote desktop software is updated immediately to prevent unauthorized access.
Technical details
A heap-based buffer overflow vulnerability exists in the Microsoft Remote Desktop Client. The flaw is triggered when the client processes a specially crafted response from a malicious or compromised RDP server. While the attack vector is network-based, it requires user interaction (UI:R), meaning a user must be induced to connect to the attacker-controlled server. Successful exploitation allows for remote code execution (RCE) in the context of the logged-in user. Although the NVD description mentions a heap overflow, the Microsoft CWE classification also references CWE-416 (Use After Free), suggesting memory corruption during session handling.
Affected products
- Microsoft Remote Desktop Client
Timeline
- 2026-06-09: advisory: Initial advisory published by Microsoft and NVD.