Microsoft Remote Desktop Client CVE-2026-42909

Exploitation requires the victim to actively initiate an RDP connection from the vulnerable Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R in CVSS) - the bug is not reachable by an unsolicited inbound packet to a listening client. The attacker must also reliably win a race condition (AC:H) between client threads handling server-sent RDP protocol data, which typically requires repeated attempts or precise timing. No authentication to the victim's environment is needed (PR:N); the limiting factors are therefore the social-engineering step to get the user to connect and the timing reliability of the race, not credentials or special target configuration.

The CVSS 7.5 base score with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H paints a nuanced picture: full CIA impact and no privileges required, but two friction factors - AC:H (race window must be hit reliably) and UI:R (the victim must initiate or accept the RDP connection) - keep this below worm-class severity. EPSS data was not provided in the input, the CVE is not on the CISA KEV list, and no public exploit code is referenced, so this is not currently confirmed actively exploited. The realistic risk profile is therefore targeted client-side exploitation (e.g., phishing a user to connect to a rogue RDP host, or compromising a legitimate jumpbox), not opportunistic mass exploitation; that said, RDP clients are heavily used by administrators and helpdesk staff, so a successful exploit gives access to high-value workstations.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a target - for example a sysadmin - into connecting via a phishing email containing a crafted .rdp file or a typosquatted hostname. Once the victim's Remote Desktop Client establishes the session, the rogue server returns specifically timed protocol messages that win the race condition and overflow a heap buffer in the client, yielding code execution in the user's session on the workstation.