This vulnerability (CVE-2026-42913) involves a race condition (CWE-362) in the Microsoft Remote Desktop client for Windows Desktop, specifically version 1.2.0.0. The race condition occurs due to improper synchronization when concurrently accessing shared resources, enabling an unauthorized attacker to execute arbitrary code over a network. The CVSS 3.1 base score is 7.5, reflecting high impact with network attack vector, high complexity, no privileges required, and user interaction required. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Remote Desktop client.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patch as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42913 for detailed remediation instructions.