CVE-2025-48817: Remote Desktop Client Remote Code Execution Vulnerability

CVE-2025-48817 is a remote code execution vulnerability in Remote Desktop Client, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.14% probability of exploitation activity in the next 30 days, higher than 67% of all scored vulnerabilities. Microsoft released the fix on 8 July 2025 in the July 2025 Patch Tuesday, delivered through 14 security updates (KB5062557, KB5062572, KB5062554, KB5062552 and more). It affects 39 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2025-48817
Severity: High CVSS 8.8
Microsoft severity: Important
Impact: Remote Code Execution
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-23; CWE-284
EPSS: 1.14% (percentile 67%)
CISA KEV: Not listed
Released: 8 July 2025
Last updated: 8 July 2025
Patch Tuesday: July 2025 Patch Tuesday
Product families: Windows, ESU

CVSS score and vector

Microsoft scores CVE-2025-48817 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

This attack requires an admin user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client.

How could an attacker exploit this vulnerability?

In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the RDP client machine when a victim connects to the attacker's server with the vulnerable Remote Desktop Client.

Affected products (39)

Windows

Product	Security update	Type	Fixed build	Restart
Windows App Client for Windows Desktop	Release Notes		2.0.559.0	Maybe
Windows 10 Version 1809 for 32-bit Systems	KB5062557	Security Update	10.0.17763.7558	Yes
Windows 10 Version 1809 for x64-based Systems	KB5062557	Security Update	10.0.17763.7558	Yes
Windows Server 2019	KB5062557	Security Update	10.0.17763.7558	Yes
Windows Server 2019 (Server Core installation)	KB5062557	Security Update	10.0.17763.7558	Yes
Remote Desktop client for Windows Desktop	Release Notes	Security Update	1.2.6353.0	Maybe
Windows Server 2022	KB5062572	Security Update	10.0.20348.3932	Yes
Windows Server 2022 (Server Core installation)	KB5062572	Security Update	10.0.20348.3932	Yes
Windows 10 Version 21H2 for 32-bit Systems	KB5062554	Security Update	10.0.19044.6093	Yes
Windows 10 Version 21H2 for ARM64-based Systems	KB5062554	Security Update	10.0.19044.6093	Yes
Windows 10 Version 21H2 for x64-based Systems	KB5062554	Security Update	10.0.19044.6093	Yes
Windows Server 2025 (Server Core installation)	KB5062553	Security Update	10.0.26100.4652	Yes
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows Server 2022, 23H2 Edition (Server Core installation)	KB5062570	Security Update	10.0.25398.1732	Yes
Windows 11 Version 24H2 for ARM64-based Systems	KB5062553	Security Update	10.0.26100.4652	Yes
Windows 11 Version 24H2 for x64-based Systems	KB5062553	Security Update	10.0.26100.4652	Yes
Windows Server 2025	KB5062553	Security Update	10.0.26100.4652	Yes
Windows 10 for 32-bit Systems	KB5062561	Security Update	10.0.10240.21073	Yes
Windows 10 for x64-based Systems	KB5062561	Security Update	10.0.10240.21073	Yes
Windows 10 Version 1607 for 32-bit Systems	KB5062560	Security Update	10.0.14393.8246	Yes
Windows 10 Version 1607 for x64-based Systems	KB5062560	Security Update	10.0.14393.8246	Yes
Windows Server 2016	KB5062560	Security Update	10.0.14393.8246	Yes
Windows Server 2016 (Server Core installation)	KB5062560	Security Update	10.0.14393.8246	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows 11 Version 22H2 for ARM64-based Systems	KB5062552	Security Update	10.0.22621.5624	Yes
Windows 11 Version 22H2 for x64-based Systems	KB5062552	Security Update	10.0.22621.5624	Yes
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows Server 2008 for 32-bit Systems Service Pack 2	KB5062624 KB5062618	Monthly Rollup Security Only	6.0.6003.23418 6.0.6003.23418	Yes Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	KB5062624 KB5062618	Monthly Rollup Security Only	6.0.6003.23418 6.0.6003.23418	Yes Yes
Windows Server 2008 for x64-based Systems Service Pack 2	KB5062624 KB5062618	Monthly Rollup Security Only	6.0.6003.23418 6.0.6003.23418	Yes Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	KB5062624 KB5062618	Monthly Rollup Security Only	6.0.6003.23418 6.0.6003.23418	Yes Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	KB5062632 KB5062619	Monthly Rollup Security Only	6.1.7601.27820 6.1.7601.27820	Yes Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	KB5062632 KB5062619	Monthly Rollup Security Only	6.1.7601.27820 6.1.7601.27820	Yes Yes
Windows Server 2012	KB5062592	Monthly Rollup	6.2.9200.25573	Yes
Windows Server 2012 (Server Core installation)	KB5062592	Monthly Rollup	6.2.9200.25573	Yes
Windows Server 2012 R2	KB5062597	Monthly Rollup	6.3.9600.22676	Yes
Windows Server 2012 R2 (Server Core installation)	KB5062597	Monthly Rollup	6.3.9600.22676	Yes

Security updates (14)

KB5062557 (Security Update)
KB5062572 (Security Update)
KB5062554 (Security Update)
KB5062552 (Security Update)
KB5062553 (Security Update)
KB5062570 (Security Update)
KB5062561 (Security Update)
KB5062560 (Security Update)
KB5062624 (Monthly Rollup)
KB5062618 (Security Only)
KB5062632 (Monthly Rollup)
KB5062619 (Security Only)
KB5062592 (Monthly Rollup)
KB5062597 (Monthly Rollup)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 8.8 (HIGH)
NVD weakness: CWE-23; CWE-284
Published to NVD: 8 July 2025
NVD last modified: 15 July 2025

Affected configurations (CPE)

Product	Vulnerable versions
remote desktop client	before 1.2.6353
windows app	before 2.0.559.0
windows 10 1507 (x64)	before 10.0.10240.21073
windows 10 1507 (x86)	before 10.0.10240.21073
windows 10 1607 (x64)	before 10.0.14393.8246
windows 10 1607 (x86)	before 10.0.14393.8246
windows 10 1809 (x64)	before 10.0.17763.7558
windows 10 1809 (x86)	before 10.0.17763.7558
windows 10 21h2	before 10.0.19044.6093
windows 10 22h2	before 10.0.19045.6093
windows 11 22h2	before 10.0.22621.5624
windows 11 23h2	before 10.0.22631.5624
windows 11 24h2	before 10.0.26100.4652
windows server 2008 (x64)	all listed versions
windows server 2008 (x86)	all listed versions
windows server 2008 r2 (x64)	all listed versions
windows server 2012	all listed versions
windows server 2012 r2	all listed versions
windows server 2016	before 10.0.14393.8246
windows server 2019	before 10.0.17763.7558
windows server 2022	before 10.0.20348.3932
windows server 2022 23h2	before 10.0.25398.1732
windows server 2025	before 10.0.26100.4652

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48817 (Vendor Advisory)

Revision history

Version	Date	Description
1.0	8 July 2025	Information published.