CVE-2026-42913
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Race condition vulnerability in Remote Desktop Client. An unauthorized attacker can execute code remotely by exploiting concurrent access to a shared resource.
Risk Assessment
Risk of remote code execution by an unauthorized attacker, potentially leading to system compromise.
Recommendation
Apply the security update from Microsoft for Remote Desktop Client. Restrict access to Remote Desktop services.
Other vulnerabilities in Remote Desktop Client
See all- CVE-2026-32157High
A use after free vulnerability in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-54990Critical
A heap-based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2021-38666High
Remote Code Execution vulnerability in Remote Desktop Client. Details are not provided in the description.
- CVE-2021-34535High
Remote code execution vulnerability in Remote Desktop Client. An attacker could exploit this to execute code remotely on the client machine.
- CVE-2026-69550Medium
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- CVE-2026-62824High
Stack-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- CVE-2026-61924Medium
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- CVE-2026-61921Medium
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- CVE-2026-61918Medium
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
- CVE-2026-61363High
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.