CVE-2025-26645 Overview
CVE-2025-26645 is a relative path traversal vulnerability in the Microsoft Remote Desktop Client that allows an unauthorized attacker to execute arbitrary code over a network. This vulnerability affects a wide range of Microsoft Windows operating systems and the Remote Desktop Client application, making it a significant security concern for enterprise environments relying on remote desktop services.
The vulnerability stems from improper validation of file paths within the Remote Desktop Client, enabling attackers to traverse directory structures and potentially execute malicious code on vulnerable systems when a user connects to a malicious RDP server.
Critical Impact
Unauthorized attackers can achieve remote code execution over a network by exploiting path traversal weaknesses in the Remote Desktop Client, potentially compromising enterprise systems that rely on RDP for remote access.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
- Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2016, 2019, 2022, 2022 23H2, 2025
- Microsoft Remote Desktop Client for Windows
- Microsoft Windows App
Discovery Timeline
- March 11, 2025 - CVE-2025-26645 published to NVD
- July 7, 2025 - Last updated in NVD database
Technical Details for CVE-2025-26645
Vulnerability Analysis
This vulnerability is classified as CWE-23 (Relative Path Traversal), a weakness that occurs when software uses external input to construct a pathname intended to identify a file or directory located underneath a restricted parent directory, but fails to properly neutralize special elements within the pathname. In the context of the Remote Desktop Client, this flaw allows attackers to break out of intended directory boundaries.
The attack requires user interaction—specifically, a victim must connect to a malicious RDP server controlled by the attacker. Once connected, the attacker can leverage the path traversal weakness to write or execute files outside the expected directory structure, leading to remote code execution on the client machine.
Root Cause
The root cause of CVE-2025-26645 lies in insufficient input validation within the Remote Desktop Client's file path handling routines. When processing certain file operations during an RDP session, the client fails to properly sanitize path components, allowing relative path sequences (such as ../) to traverse the directory hierarchy. This enables an attacker-controlled server to manipulate file operations beyond the intended scope.
Attack Vector
The attack vector for this vulnerability is network-based and requires the following conditions:
- Malicious RDP Server: The attacker must control or compromise an RDP server that the victim connects to
- User Interaction: A victim must initiate an RDP connection to the malicious server
- Path Traversal Exploitation: During the RDP session, the attacker sends crafted responses containing relative path traversal sequences
- Code Execution: The traversal allows the attacker to write malicious files to arbitrary locations or execute code on the victim's system
The vulnerability can be exploited remotely without requiring any authentication from the attacker's perspective, though the victim must actively connect to the malicious endpoint.
Detection Methods for CVE-2025-26645
Indicators of Compromise
- Unusual outbound RDP connections to unknown or suspicious IP addresses
- Unexpected file creation or modification in system directories outside typical RDP working folders
- Remote Desktop Client (mstsc.exe) or Windows App processes spawning unexpected child processes
- Log entries indicating connections to unrecognized RDP servers
Detection Strategies
- Monitor for RDP connection attempts to external, non-approved servers using network traffic analysis
- Implement endpoint detection rules to identify path traversal patterns in file operations initiated by RDP client processes
- Review Windows Security Event logs for suspicious file system access patterns during active RDP sessions
- Deploy behavioral analysis to detect mstsc.exe or msrdc.exe performing file operations in sensitive directories
Monitoring Recommendations
- Enable enhanced logging for Remote Desktop Client activity and RDP connection events
- Configure SIEM rules to alert on RDP connections to IP addresses outside approved allow-lists
- Monitor for anomalous file system activity during and immediately after RDP sessions
- Implement network segmentation to restrict RDP traffic to known, trusted endpoints
How to Mitigate CVE-2025-26645
Immediate Actions Required
- Apply the latest Microsoft security updates for all affected Windows versions and Remote Desktop Client applications immediately
- Restrict RDP client connections to approved, trusted servers only through Group Policy or firewall rules
- Educate users about the risks of connecting to unknown or untrusted RDP servers
- Consider disabling RDP client functionality on systems where it is not required
Patch Information
Microsoft has released security updates to address CVE-2025-26645 as part of their regular Patch Tuesday cycle. Detailed patch information and download links are available in the Microsoft Security Update Guide for CVE-2025-26645. Organizations should prioritize deploying these updates across all affected systems, including:
- Windows 10 and Windows 11 client systems
- Windows Server 2008 through Windows Server 2025
- Microsoft Remote Desktop Client application
- Microsoft Windows App
Workarounds
- Configure network firewalls to block outbound RDP connections to unauthorized destinations
- Use Group Policy to restrict Remote Desktop Client connections to approved server addresses only
- Deploy application control policies to monitor and restrict RDP client behavior
- Implement network-level authentication (NLA) requirements for all RDP connections to add an additional layer of protection
# Windows Firewall rule to restrict outbound RDP to specific trusted servers
netsh advfirewall firewall add rule name="Restrict RDP Outbound" dir=out action=block protocol=tcp remoteport=3389
netsh advfirewall firewall add rule name="Allow RDP to Trusted Server" dir=out action=allow protocol=tcp remoteport=3389 remoteip=10.0.0.100,10.0.0.101
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
