This vulnerability (CVE-2026-42909) affects Microsoft Remote Desktop client for Windows Desktop version 1.2.0.0. It is classified as a race condition (CWE-362) resulting in a heap-based buffer overflow. The flaw allows remote code execution by an attacker without privileges or user interaction, though the attack complexity is high and user interaction is required. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the target machine. The attack requires network access, high attack complexity, and user interaction, but no privileges are needed prior to exploitation.

An official patch is available from Microsoft to remediate this vulnerability. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42909 promptly to mitigate the risk. No additional mitigation steps are indicated by the vendor advisory.