Microsoft Remote Desktop Client: Double free leads to remote code execution
Summary
A double free vulnerability (CWE-415) in the Microsoft Remote Desktop Client allows an unauthenticated attacker to execute code over the network. Exploitation requires a user to interact, for example by connecting to a malicious RDP host or opening a manipulated RDP file. The CVSS base score is 8.8 (high), and the impact on confidentiality, integrity and availability is rated high.
Affected
- Windows 10 Version 1607, 1809, 21H2 and 22H2 (builds below the fixed versions in the CVE record)
- Windows 11 Version 23H2, 24H2, 25H2, 26H1 and 26H2 (builds below the fixed versions in the CVE record)
- Windows Server 2016, 2019 and 2022 (including Server Core)
- Exact fixed builds for all products: see the MSRC advisory, as the full list could not be verified
Fixed in
- Fixed in the November 2026 security update for the affected Windows versions, according to the CVE record and Patch Tuesday coverage
- Minimum fixed builds per the CVE record include 10.0.14393.9688 (1607), 10.0.17763.9487 (1809) and 10.0.19044.7846 (21H2); other fixed builds: see the MSRC advisory
Workaround
Unknown.
- No vendor workaround was found in the sources reviewed.
Exploitation
- Exploited in the wild: not confirmed.
- Public proof of concept: none found.
- Exploit maturity in the CVE record: Unproven.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- CISA KEV status: not checked.
Our recommendation
- Install the November 2026 Microsoft security update on all affected Windows workstations and servers, prioritising workstations and admin PCs.
- Until patched, connect only to trusted RDP hosts and do not open untrusted .rdp files.
- Check where the Remote Desktop Client is used, including connections to external or untrusted hosts.
- Monitor for vendor updates and check the MSRC advisory for the exact fixed builds.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Remote Desktop Client
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-119934 www.cve.org
- Microsoft Security Update Guide CVE-2026-119934 msrc.microsoft.com
- BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:37.
Original description (NVD)
Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.