Executive brief
A security vulnerability exists in the Microsoft Remote Desktop Client, a tool used by employees to access remote computers and servers. An attacker could exploit this flaw to take control of a user's computer if the user is tricked into connecting to a malicious server. This could lead to the theft of sensitive data, installation of malware, or a complete compromise of the affected workstation.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Microsoft Remote Desktop Client. The vulnerability is triggered when the client processes specially crafted data from a malicious or compromised Remote Desktop Protocol (RDP) server. While the attack vector is network-based and requires no prior privileges, it has high complexity and requires user interaction, specifically enticing a user to connect to a rogue RDP server. Successful exploitation allows for remote code execution (RCE) in the context of the logged-on user. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Remote Desktop Client
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory