Update MSRDC to 1.2.7214 to fix CVE-2026-32157 (#40882)
Bumps Microsoft.RemoteDesktop.Client.MSRDC.SessionHost from 1.2.6676 to 1.2.7214. This closes CVE-2026-32157 (a use-after-free RCE in the Remote Desktop client, first fixed in 1.2.7099) along with several additional CVEs shipped in 1.2.7214. Fixes #40868 Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
Jun 23, 2026 at 14:10 UTC
2a7269e8ab30e635a09f66994374a7e5caedc334
1 file changed
+1
-1
packages.config
+1
-1
@@ -10,7 +10,7 @@
10
<package id="Microsoft.Identity.MSAL.WSL.Proxy" version="0.1.1" />
11
<package id="Microsoft.NETCore.App.Runtime.win-arm64" version="10.0.8" />
12
<package id="Microsoft.NETCore.App.Runtime.win-x64" version="10.0.8" />
13
- <package id="Microsoft.RemoteDesktop.Client.MSRDC.SessionHost" version="1.2.6676" />
13
+ <package id="Microsoft.RemoteDesktop.Client.MSRDC.SessionHost" version="1.2.7214" />
14
<package id="Microsoft.Taef" version="10.100.251104001" targetFramework="native" />
15
<package id="Microsoft.Windows.CsWinRT" version="2.2.0" />
16
<package id="Microsoft.Windows.ImplementationLibrary" version="1.0.251108.1" targetFramework="native" />