PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42993 Microsoft CVE debrief

CVE-2026-42993 is a high-severity vulnerability in the Remote Desktop Client that allows an unauthorized attacker to execute code over a network. The vulnerability is caused by a heap-based buffer overflow and has a CVSS score of 7.5.

Vendor
Microsoft
Product
Windows 10 Version 21H2
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-15
Advisory published
2026-06-09
Advisory updated
2026-06-15

Who should care

Administrators and users of Microsoft Remote Desktop Client are advised to take action to mitigate this vulnerability.

Technical summary

The vulnerability is a heap-based buffer overflow in the Remote Desktop Client, which allows an unauthorized attacker to execute code over a network. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates provided by Microsoft to vulnerable systems.
  • Implement network segmentation and isolation to limit the attack surface.
  • Monitor Remote Desktop Client usage and detect potential exploitation attempts.

Evidence notes

The vulnerability is described in the CVE record and NVD detail pages. Microsoft has provided a vendor advisory for this vulnerability.

Official resources

CVE-2026-42993 was published on 2026-06-09T17:17:15.503Z and modified on 2026-06-15T20:10:54.230Z.