Heap-Based Buffer Overflow in Remote Desktop Client by Microsoft
CVE-2026-42913

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Remote Desktop Client For Windows Desktop
Windows 11 Version 23h2
Windows 11 Version 23h2
Windows 11 Version 24h2
Vendor
CVE Published:
9 June 2026

What is CVE-2026-42913?

A heap-based buffer overflow vulnerability in the Remote Desktop Client has been identified, allowing unauthorized attackers to execute arbitrary code over a network. This critical issue can be exploited if an attacker sends specially crafted packets to the affected client, leading to potential system compromise. Users are advised to update their software immediately to mitigate the risks associated with this vulnerability.

Affected Version(s)

Remote Desktop client for Windows Desktop 1.2.0.0 < 1.2.7214.0

Windows 11 version 23H2 ARM64-based Systems 10.0.22631.0 < 10.0.22631.7219

Windows 11 Version 23H2 x64-based Systems 10.0.22631.0 < 10.0.22631.7219

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.