Windows Remote Desktop Client: Use-after-free allows remote code execution

Summary

A use-after-free flaw (CWE-416) in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. The CVSS vector requires no privileges but user interaction, so a user must take an action such as connecting to a malicious host or opening a crafted RDP file. The CNA record lists many Windows 10, 11 and Server builds, while the CPE data covers only Windows 10 1607, so the exact scope must be confirmed against the MSRC build table.

Affected

• Windows 10 Version 1607 (CPE entry; CNA range 10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809, 21H2, 22H2 and Windows 11 23H2, 24H2, 25H2, 26H1, 26H2 (see CNA record for build ranges)
• Windows Server 2012, 2012 R2 and 2016 (see CNA record for build ranges)
• Scope conflicts between sources; verify on the MSRC advisory.

Fixed in

• The CNA record gives upper build limits for each affected branch, which suggests fixed builds; these are not confirmed in the sources reviewed.
• No October 2026 update (KB) for build 14393 (Windows 10 1607) was found.
• Windows 10 Enterprise LTSB 2016 (1607) reached end of updates on October 13, 2026. The only route to updates is paid Extended Security Updates (ESU); whether an ESU build covers this CVE is unverified.

Workaround

• No Microsoft workaround found in the sources reviewed.
• Only connect to trusted RDP hosts and do not open .rdp files from untrusted sources.
• Block outbound RDP (TCP 3389) from client networks where it is not required.
• Restrict the number of users and devices that run the Remote Desktop Client.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept or evidence of active exploitation found in the sources reviewed (CISA KEV not directly checked).
• EPSS 0.00767 (low).
• Tenable plugin pages show an 'Exploit Available' flag for the whole advisory group; this does not confirm exploitation of this CVE.

Our recommendation

• Inventory all Windows 10 1607 (LTSB 2016) devices and their use of the Remote Desktop Client.
• Decide between migrating to Windows 11 Enterprise LTSC 2024 and buying ESU; unpatched 1607 devices receive no further Microsoft security updates.
• Check the MSRC advisory build table for the exact affected and fixed builds of every device.
• Apply the user-side and network mitigations above until devices are remediated.
• Train users to be wary of unexpected RDP files and links.
• Monitor for unusual outbound RDP connections.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-103575 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-103575 vulners.com
• Microsoft: Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
• 4sysops: Windows 10 LTSB 2016 end of support and ESU 4sysops.com
• VulDB: vulnerability 418048 vuldb.com
• Tenable plugin 365473 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:24.