Windows Remote Desktop: Denial of Service via NULL pointer dereference
Summary
A NULL pointer dereference in the Windows Remote Desktop service allows an unauthenticated attacker to crash the service or the host over the network. No login or user interaction is required, and the CVSS vector scores only availability impact (no confidentiality or integrity impact). Any Windows system with RDP reachable from the network is affected.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9688)
- Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9487)
- Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7846)
- Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7846)
- Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7711)
- Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9974)
- Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9974)
- Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3501)
- Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9974)
- Windows App Client for Windows Desktop (1.00 to < 2.0.1489.0)
- Windows Server 2016 incl. Server Core (10.0.14393.0 to < 10.0.14393.9688)
- Windows Server 2019 incl. Server Core (10.0.17763.0 to < 10.0.17763.9487)
Fixed in
- Windows 10 Version 1607 / Windows Server 2016: 10.0.14393.9688
- Windows 10 Version 1809 / Windows Server 2019: 10.0.17763.9487
- Windows 10 Version 21H2: 10.0.19044.7846
- Windows 10 Version 22H2: 10.0.19045.7846
- Windows 11 Version 23H2: 10.0.22631.7711
- Windows 11 Version 24H2: 10.0.26100.9974
- Windows 11 Version 25H2: 10.0.26200.9974
- Windows 11 Version 26H1: 10.0.28000.3501
- Windows 11 Version 26H2: 10.0.26300.9974
- Windows App Client for Windows Desktop: 2.0.1489.0
KB article numbers: Unknown. Verify on the MSRC advisory.
Workaround
Unknown. No vendor workaround was identified.
General measures, not confirmed by the vendor:
- Restrict RDP to VPN or an RD Gateway.
- Block TCP port 3389 at the perimeter firewall.
- Remove any direct internet exposure of RDP.
Exploitation
- Exploit code maturity is 'Unproven' (E:U) according to the CVSS temporal vector in the CVE record, so no known exploit code was reported at publication.
- CISA SSVC: exploitation 'none', automatable 'yes', technical impact 'partial'.
- No exploitation in the wild has been reported as of 11 Nov 2026.
Our recommendation
- Inventory all systems with RDP enabled, including servers, desktops and RD Gateway/RDS roles, and compare their builds with the MSRC table.
- Apply the Microsoft security update for November 2026 as soon as possible, after checking the KB numbers on MSRC.
- Retire Windows 10 1607 and 1809 systems or confirm they are patched.
- Restrict RDP to VPN or RD Gateway with MFA and block port 3389 from the internet.
- Monitor RDP service crashes and unusual connection attempts.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Denial of service – Windows Remote Desktop
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-119932 www.cve.org
- Microsoft Security Update Guide CVE-2026-119932 msrc.microsoft.com
- Strix CVE-2026-119932 www.strix.ai
- Change Risk Intel: November 2026 Patch Tuesday changeriskintel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:28.
Original description (NVD)
Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.