CVE-2026-42913
Remote Desktop Client Remote Code Execution Vulnerability
At a glance Severity HIGH 7.5 EPSS EPSS 0.47 % · percentile 41 (2026-10-27) State PUBLISHED Published 2026-06-09 Updated 2026-09-24 Assigner microsoft NVD status Modified Description Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Scores Version Score Vector Scored by CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C microsoft CVSS 3.1 HIGH 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H NVD · secure@microsoft.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:microsoft:remote_desktop_client:*:*:*:*:*:windows:*:* < 1.2.7214cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* < 10.0.22631.7219cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* < 10.0.22631.7219cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* < 10.0.26100.8655cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* < 10.0.26100.8655cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* < 10.0.26200.8655cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* < 10.0.26200.8655cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* < 10.0.28000.2269cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* < 10.0.28000.2269cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:-:*:x64:* < 10.0.20348.5256cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:* < 10.0.26100.32995Affected products
References
Sources
