Microsoft Patches Four Critical Windows Remote Desktop Client Vulnerabilities
Microsoft has released security updates for four critical vulnerabilities in its Windows Remote Desktop Client, some of which allow for remote code execution.
Microsoft has addressed four significant vulnerabilities affecting its Windows Remote Desktop Client, with patches now available for Windows 10, 11, and Server operating systems. These flaws, disclosed on November 10, 2026, primarily involve memory corruption errors and a race condition, with several offering pathways for attackers to execute code remotely over a network.
The most critical of these, CVE-2026-119934, is a double-free vulnerability with a CVSS score of 8.8. This flaw can lead to remote code execution if a user connects their Windows Remote Desktop Client to a malicious server. The attacker would host this server and then trick the user into connecting, after which the client would process a malicious response, corrupting memory and allowing for code execution. While user interaction is required, no prior account access is necessary, making it a significant threat for targeted attacks.
Another network-exploitable vulnerability, CVE-2026-119858, is a heap-based buffer overflow. This type of vulnerability occurs when data exceeds the allocated buffer space in memory, potentially leading to code execution. Microsoft notes that exploitation for this flaw is dependent on specific configurations or protocol settings, which may limit its widespread applicability but does not diminish the importance of patching.
A race condition vulnerability, tracked as CVE-2026-95964, also presents a remote code execution risk. This flaw arises from improper synchronization when multiple operations access a shared resource. Successful exploitation requires precise timing to win the race condition, making it technically challenging but still a potential vector for attackers. Microsoft rates exploitation as unlikely due to this complexity, though it still carries a CVSS score of 7.5.
The fourth vulnerability, CVE-2026-119390, is a local heap-based buffer overflow with a CVSS score of 7.8. Unlike the others, this flaw requires an attacker to have existing local access to the target system and low privileges. No further user interaction is needed once local access is gained, making it a critical concern for systems that may already be compromised by other means.
While these vulnerabilities are client-side focused, meaning an attacker must entice a user to connect to a malicious server, they are not unprecedented. Previous campaigns have successfully used social engineering tactics, such as malicious RDP connection files delivered via email, to direct users to attacker-controlled servers. These new flaws add to the arsenal of potential attacks that leverage user interaction with the Remote Desktop Client.
Microsoft has provided specific updates for various Windows 10, Windows 11, and Windows Server versions, as well as for the Windows App Client for Windows Desktop. Administrators are urged to consult the detailed product tables for each CVE to ensure all affected systems and applications are patched. As of the publication date, Microsoft reported no active exploitation for CVE-2026-119934, CVE-2026-119390, and CVE-2026-95964, underscoring the importance of proactive patching to prevent future attacks.