PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42992 Microsoft CVE debrief

CVE-2026-42992 is a high-severity vulnerability in the Remote Desktop Client, allowing unauthorized attackers to execute code over a network. The vulnerability is caused by a heap-based buffer overflow and has a CVSS score of 7.5.

Vendor
Microsoft
Product
Windows 10 Version 1607
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-15
Advisory published
2026-06-09
Advisory updated
2026-06-15

Who should care

Users of Microsoft Windows App, Windows 10, Windows 11, and Windows Server products are affected by this vulnerability.

Technical summary

The vulnerability is caused by a heap-based buffer overflow in the Remote Desktop Client. This allows an unauthorized attacker to execute code over a network. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Defensive priority

High

Recommended defensive actions

  • Apply patches from Microsoft as soon as possible.
  • Use secure communication protocols for Remote Desktop Client connections.
  • Limit access to Remote Desktop Client to only necessary users.

Evidence notes

The CVE record and NVD detail pages provide additional information about this vulnerability.

Official resources

CVE-2026-42992 was published on 2026-06-09T17:17:15.333Z and modified on 2026-06-15T20:13:24.283Z.