7.5
High
CVE-2026-42909 Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client…
Description
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Remote Desktop client for Windows Desktop 1.2 | 1.2.0.0 → < 1.2.7214.0 | 1.2.7214.0 |
| Windows 10 Version 1607 10.0 | 10.0.14393.0 → < 10.0.14393.9234 | 10.0.14393.9234 |
| Windows 10 Version 1809 10.0 | 10.0.17763.0 → < 10.0.17763.8880 | 10.0.17763.8880 |
| Windows 10 Version 21H2 10.0 | 10.0.19044.0 → < 10.0.19044.7417 | 10.0.19044.7417 |
| Windows 10 Version 22H2 10.0 | 10.0.19045.0 → < 10.0.19045.7417 | 10.0.19045.7417 |
| Windows 11 Version 23H2 10.0 | 10.0.22631.0 → < 10.0.22631.7219 | 10.0.22631.7219 |
| Windows 11 Version 24H2 10.0 | 10.0.26100.0 → < 10.0.26100.8655 | 10.0.26100.8655 |
| Windows 11 Version 25H2 10.0 | 10.0.26200.0 → < 10.0.26200.8655 | 10.0.26200.8655 |
| Windows 11 version 26H1 10.0 | 10.0.28000.0 → < 10.0.28000.2269 | 10.0.28000.2269 |
Show the 12 other branches Hide the 12 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Windows App Client for Windows Desktop 1.00 | 1.00 → < 2.0.1193.0 | 2.0.1193.0 |
| Windows Server 2012 6.2 | 6.2.9200.0 → < 6.2.9200.26132 | 6.2.9200.26132 |
| Windows Server 2012 (Server Core installation) 6.2 | 6.2.9200.0 → < 6.2.9200.26132 | 6.2.9200.26132 |
| Windows Server 2012 R2 6.3 | 6.3.9600.0 → < 6.3.9600.23228 | 6.3.9600.23228 |
| Windows Server 2012 R2 (Server Core installation) 6.3 | 6.3.9600.0 → < 6.3.9600.23228 | 6.3.9600.23228 |
| Windows Server 2016 10.0 | 10.0.14393.0 → < 10.0.14393.9234 | 10.0.14393.9234 |
| Windows Server 2016 (Server Core installation) 10.0 | 10.0.14393.0 → < 10.0.14393.9234 | 10.0.14393.9234 |
| Windows Server 2019 10.0 | 10.0.17763.0 → < 10.0.17763.8880 | 10.0.17763.8880 |
| Windows Server 2019 (Server Core installation) 10.0 | 10.0.17763.0 → < 10.0.17763.8880 | 10.0.17763.8880 |
| Windows Server 2022 10.0 | 10.0.20348.0 → < 10.0.20348.5256 | 10.0.20348.5256 |
| Windows Server 2025 10.0 | 10.0.26100.0 → < 10.0.26100.32995 | 10.0.26100.32995 |
| Windows Server 2025 (Server Core installation) 10.0 | 10.0.26100.0 → < 10.0.26100.32995 | 10.0.26100.32995 |
References
- Remote Desktop Client Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Remote Desktop client for Windows Desktop
The 37 CVEs of Remote Desktop client for Windows Desktop →
CVE-2026-80077
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network
8.8
High
CVE-2026-80074
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network
8.8
High
CVE-2026-78463
Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to…
8.8
High
CVE-2026-57098
Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose…
7.5
High