CVE-2026-78463: CWE-94: Improper Control of Generation of Code ('Code Injection') in Microsoft Remote Desktop client for Windows Desktop

This vulnerability (CVE-2026-78463) in Microsoft Remote Desktop client for Windows Desktop is due to improper control of code generation, enabling code injection. An attacker can exploit this flaw remotely without privileges and with low attack complexity, requiring user interaction. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Remote Desktop client.

An official fix is available from Microsoft. Users and administrators should apply the update provided by Microsoft for Remote Desktop client versions prior to 1.2.7279.0 to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78463 for detailed patch information and update instructions.