CVE-2026-42909
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Remote Desktop Client has a race condition vulnerability in concurrent execution using a shared resource. An unauthorized attacker can execute code remotely.
Risk Assessment
An attacker can remotely execute arbitrary code on the victim's system, potentially leading to full system compromise and data theft.
Recommendation
Immediately install security patches released by Microsoft for the Remote Desktop Client.
Other vulnerabilities in Remote Desktop Client
See all- CVE-2026-97789High
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-83688High
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-54990Critical
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2021-38666High
Remote Code Execution vulnerability in Remote Desktop Client. Details are not provided in the description.
- CVE-2021-34535High
Remote code execution vulnerability in Remote Desktop Client. An attacker could exploit this to execute code remotely on the client machine.
- CVE-2026-83998High
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-80077High
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-80074High
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-78463High
Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-77896Medium
Integer overflow or wraparound in Remote Desktop Client allows an unauthenticated attacker to perform a denial of service attack over a network.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS