CVE-2026-62824 – Remote Desktop Client Remote Code Execution Vulnerability

A stack-based buffer overflow in Microsoft Remote Desktop Client could allow an unauthorized attacker to execute code over a network. An attacker could host a malicious server and convince a user on an affected client to connect to it. Processing the malicious server response can trigger the vulnerability and lead to code execution. The attack requires no privileges but does require user interaction.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
An attacker can use a malicious Remote Desktop server to target vulnerable clients over the network. Attack complexity is low, privileges are not required, and successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS:
The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
The vulnerability is caused by a stack-based buffer overflow (CWE-121) in the Remote Desktop Client. An attacker could operate a malicious server and convince a user with an affected client to connect to it. When the client processes the malicious server response, the buffer overflow can occur and allow the attacker to execute code on the client system. The attack is network-based, has low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can significantly affect the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY:
Affected products are Windows 10 Version 1607 for 32-bit and x64-based systems; Windows Server 2012 and Server Core; Windows Server 2012 R2 and Server Core; and Windows Server 2016 and Server Core. Exploitation requires a user to connect an affected Remote Desktop Client to an attacker-controlled malicious server.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on affected systems, creating risks to sensitive information, system integrity, and service availability. Compromise of business endpoints or servers could disrupt operations and expose systems to further attacker-controlled activity.

WORKAROUND:
No workaround or mitigation is identified. An official security fix is available, and installing the applicable update is the stated remediation.

URGENCY:
This vulnerability is rated Critical and can enable remote code execution with low attack complexity and no attacker privileges. Although exploitation is currently assessed as less likely and no exploitation is reported, affected systems should be prioritized for deployment of the official security update because successful exploitation could have high confidentiality, integrity, and availability impacts.