Executive brief
A security vulnerability exists in the Microsoft Remote Desktop Client, a tool used by employees to access remote computers and servers. An attacker could exploit this flaw to gain control over a user's computer if the user is tricked into connecting to a malicious server. This could lead to the theft of sensitive data, installation of malware, or a complete compromise of the affected workstation.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in the Microsoft Remote Desktop Client. The flaw is triggered when the client processes specially crafted data from a malicious Remote Desktop server. While the attack vector is network-based and requires no special privileges, it has high complexity and requires user interaction, as a user must be induced to connect to a compromised or malicious RDP server. Successful exploitation allows for remote code execution (RCE) in the context of the logged-on user, potentially leading to full system compromise. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Remote Desktop Client
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Microsoft released security update guide.