CVE-2025-26645: Remote Desktop Client Remote Code Execution Vulnerability
Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Other sources
Remote Desktop Client Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22470Patch KB5053887 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.365.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.7009Patch KB5053596 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.6003.23168Patch KB5053995 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.25368Patch KB5053886 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.7601.27618Patch KB5053627 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.10240.20947Patch KB5053618 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.7876Patch KB5053594 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.3476Fixed in 10.0.26100.3403Patch KB5053636 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.5039Patch KB5053602 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.1486Patch KB5053599 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.5608Patch KB5053606 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22621.5039Patch KB5053602 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.5608Patch KB5053606 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.3328Fixed in 10.0.20348.3270Patch KB5053638 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.6017.0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-26645?
CVE-2025-26645 has a critical severity level, indicating a high risk of exploitation.
How do I fix CVE-2025-26645?
To fix CVE-2025-26645, apply the latest security patches provided by Microsoft for affected products.
What products are affected by CVE-2025-26645?
CVE-2025-26645 affects multiple versions of Windows Server and Windows operating systems, including Windows 10 and Windows 11.
Can CVE-2025-26645 lead to remote code execution?
Yes, CVE-2025-26645 allows unauthorized attackers to execute code remotely on affected systems.
Is there a workaround for CVE-2025-26645 until I can apply the patch?
There are currently no recommended workarounds available for CVE-2025-26645, so patching is essential.