Executive brief
Microsoft's Remote Desktop Client contains a use of uninitialized resource vulnerability that allows an authorized attacker to execute arbitrary code on a remote system over the network. An attacker with valid credentials could leverage this flaw to gain full control of a user's desktop, potentially leading to data theft, system compromise, or lateral movement within an organization's network.
Technical details
The vulnerability is a use-of-uninitialized-resource flaw in the Remote Desktop Client that can be triggered by an authorized attacker sending specially crafted network traffic. The attack requires network access and valid authentication credentials to trigger. By exploiting this issue, an attacker can execute arbitrary code with the privileges of the user running the Remote Desktop Client. Patches from Microsoft are expected; administrators should apply security updates as soon as they become available.
Affected products
- Microsoft Remote Desktop Client <UNKNOWN>
Timeline
- 2026-09-08: disclosed