Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-80077: Microsoft Remote Desktop Client can let attackers run code

CVE-2026-80077 · published 1 month ago

Summary

The Remote Desktop client for Windows can be tricked into running malicious code when it receives specially crafted data over the network. This could let an attacker take control of the affected computer. Apply the latest Microsoft update or patch to fix the issue.

What to do

Update microsoft remote desktop client for windows desktop to version 1.2.7279.0 or later.
Update microsoft remote_desktop_client to version 1.2.7279 or later.

Affected software

Vendor	Product	Affected versions
microsoft	remote desktop client for windows desktop	< 1.2.7279.0
microsoft	remote_desktop_client	< 1.2.7279 `cpe:2.3:a:microsoft:remote_desktop_client::::::windows::*`

Original advisory text

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80077 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published8 Sep 2026

Updated31 Oct 2026

First seen8 Sep 2026

Sources

CVE-2026-80077 · NVD

CVE-2026-80077 · MITRE

Track software like this

Free during beta