What is the CVSS score of CVE-2026-42913?

CVE-2026-42913 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remote Desktop Client are affected by CVE-2026-42913?

Microsoft Remote Desktop Client vulnerability (CVE-2026-42913) enables remote code execution on client machines when users connect to attacker-controlled RDP servers.. A patch is available.

How to fix or mitigate CVE-2026-42913?

Within 24 hours: Identify all systems running Microsoft Remote Desktop Client and assess exposure to untrusted RDP connections. Within 7 days: Apply the vendor-released patch referenced in Microsoft MSRC advisory CVE-2026-42913 to all affected Remote Desktop Client installations. Within 30 days: Verify patch deployment across all systems and confirm no unpatched Remote Desktop Client instances remain in use.

Remote Desktop Client CVE-2026-42913

EUVD-2026-35724 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-m239-3rrf-2x78

Race Condition Buffer Overflow Remote Desktop Client Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:37 vuln.today

DescriptionCVE.org

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Remote Desktop Client is possible when a user connects to an attacker-controlled RDP server, where a heap-based buffer overflow triggered by a race condition (CWE-362) allows arbitrary code execution on the client machine. The flaw carries a CVSS 7.5 (High) rating with high attack complexity and required user interaction, and no public exploit identified at time of analysis. Microsoft has released a patch via MSRC advisory CVE-2026-42913.

Technical ContextAI

The Remote Desktop Client is Microsoft's RDP client implementation (mstsc.exe and related components) used to establish remote sessions to Windows hosts. The root cause is a CWE-362 race condition that leads to a heap-based buffer overflow - concurrent operations on heap-allocated buffers (likely during RDP channel negotiation, virtual channel data handling, or graphics decoding) reach an inconsistent state where memory is written past allocated bounds. The 'Buffer Overflow' and 'Race Condition' tags from the intelligence sources confirm the dual nature: the race window is the trigger, and corrupted heap metadata or adjacent objects become the primitive for code execution. Because the flaw resides in the client (not the RDP server service), the attack model is inverted from typical RDP CVEs - a malicious or compromised RDP server attacks connecting clients.

RemediationAI

Apply the patch available per Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42913, deploying the cumulative update or standalone Remote Desktop client release that lists CVE-2026-42913 as fixed for each affected platform; exact fix build numbers should be taken from that advisory and not inferred. As compensating controls until patches are deployed, restrict outbound RDP (TCP/3389 and UDP/3389) at the perimeter so endpoints cannot connect to arbitrary external RDP servers - accepting the trade-off that legitimate remote-to-cloud or vendor-managed RDP use will break and require allowlisting; additionally instruct administrators not to connect to RDP endpoints provided by untrusted parties via .rdp files in emails or web downloads, since UI:R means the user must initiate the connection. Where feasible, route privileged RDP through a Remote Desktop Gateway with strict server allowlisting to remove the ability for users to point their client at an attacker-controlled host.