Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by persuading a user to connect with the Remote Desktop client to a system that presents a specially crafted Remote Desktop Protocol (RDP) certificate. When the client processes the malformed certificate during the connection process, the attacker could run code on the user’s device in the context of the Remote Desktop client, with the same privileges as the user running it.
Security updates
10.0.17763.8880 — https://support.microsoft.com/help/5094123
10.0.20348.5256 — https://support.microsoft.com/help/5094128
10.0.19044.7417 — https://support.microsoft.com/help/5094127
10.0.26100.32995 — https://support.microsoft.com/help/5094125
10.0.26200.8655 — https://support.microsoft.com/help/5094126
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.28000.2269 — https://support.microsoft.com/help/5095051
10.0.14393.9234 — https://support.microsoft.com/help/5094122
6.2.9200.26132 — https://support.microsoft.com/help/5094042
6.3.9600.23228 — https://support.microsoft.com/help/5094041
2.0.1193.0 — https://learn.microsoft.com/en-us/windows-app/whats-new?toc=admins%2Ftoc.json&tabs=windows
Vulnerabilities 1
-
High 8.8
Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-47289 Remote Desktop Client Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47289
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss