Remote Desktop Client Heap-Based Buffer Overflow RCE

CVE-2026-42992 is a critical remote code execution vulnerability in Microsoft Remote Desktop Client caused by a heap-based buffer overflow. The flaw is triggered in the client when it processes data from a Remote Desktop connection to a malicious or attacker-controlled Remote Desktop Server. Microsoft states that an unauthorized attacker can execute code over a network if a victim uses a vulnerable Remote Desktop Client to connect to the attacker-controlled server. The issue is classified as a heap-based buffer overflow in the client’s heap handling during RDP session processing.