What is the CVSS score of CVE-2026-42909?

CVE-2026-42909 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Remote Desktop Client are affected by CVE-2026-42909?

Microsoft Remote Desktop Client is vulnerable to remote code execution (CVE-2026-42909, CVSS 7.5) when users connect to compromised or attacker-controlled RDP servers, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-42909?

24 hours: Restrict RDP connectivity to internal jump hosts or bastion servers only; disable RDP on non-essential systems; implement firewall rules blocking RDP access from untrusted networks. 7 days: Deploy enhanced logging and alerting on RDP authentication attempts; audit and restrict active RDP access permissions; evaluate RDP gateway or centralized bastion host deployment. 30 days: Monitor Microsoft security advisories for patch release; establish change management and testing plan for Microsoft Remote Desktop Client patching.

Microsoft Remote Desktop Client CVE-2026-42909

EUVD-2026-35599 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-2mfp-vqrw-7p7v

Race Condition Buffer Overflow Remote Desktop Client Windows App Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:41 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled or compromised RDP endpoint, where a race condition (CWE-362) can be triggered to corrupt heap memory and execute arbitrary code in the client process. The flaw is unauthenticated from the network attacker's perspective but requires user interaction to initiate the connection, and no public exploit has been identified at time of analysis.

Technical ContextAI

Microsoft Remote Desktop Client implements the Remote Desktop Protocol (RDP/T.128) over channels that multiplex graphics, input, virtual channels, and clipboard/drive redirection data from the server. The combination of CWE-362 (concurrent execution using shared resource with improper synchronization, i.e., a race condition) with the heap-based buffer overflow described indicates a time-of-check to time-of-use class issue: one thread validates or sizes a buffer while another mutates the underlying data or state, allowing an attacker-controlled server response to land in an undersized heap allocation. Because the bug lives in the client-side parser/dispatch path rather than the server, the trust direction is inverted relative to classic RDP server bugs like BlueKeep - here the malicious endpoint attacks the user who connects to it.

RemediationAI

Patch availability and exact fix versions are not enumerated in the provided data, so consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42909 and apply the Patch Tuesday updates listed for each affected Remote Desktop Client SKU (Windows in-box mstsc.exe, Windows App, macOS/iOS/Android Remote Desktop apps) on the relevant platforms. Until patched, compensating controls include instructing users to only initiate RDP sessions to known internal gateway hostnames, blocking outbound TCP/3389 and UDP/3389 from user workstations at the egress firewall except to sanctioned RD Gateways (trade-off: breaks ad-hoc RDP to home labs and third parties), and routing all RDP through an RD Gateway / Azure Bastion so connections to arbitrary attacker-controlled servers cannot be made; user education on not clicking .rdp files from email is a low-cost adjunct since UI:R is required.