Windows Remote Desktop Client: Use-after-free remote code execution

Summary

A use-after-free flaw (CWE-416) in the Remote Desktop Client of Windows allows remote code execution. Affected are Windows 10, Windows 11 and Windows Server 2012, 2012 R2 and 2016 with builds below the fixed versions. Microsoft rates the attack complexity as high and requires user interaction, so an attacker would most likely need a user to connect to a hostile or compromised RDP endpoint. Microsoft's CVSS score is 7.5 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 / Server 2016: 10.0.14393.9612 (KB number unknown)
• Windows 10 Version 1809 / Server 2019: 10.0.17763.9376 (KB5126651)
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 26H2: 10.0.26100.9711 and 10.0.26300.9711
• Windows 11 Version 25H2: 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Server 2025: KB5126646

Whether Windows 10 Version 1607 receives this fix via standard support or ESU is unknown.

Workaround

Unknown. Microsoft provides a fix; no vendor-documented workaround was found.

Exploitation

• Not exploited at publication according to Microsoft; exploitability is assessed as 'Exploitation Unlikely'.
• Microsoft requires user action for exploitation.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• EPSS 0.00569 (low).
• VulDB estimates an exploit price of USD 25k to 100k; this is a market estimate, not an observed exploit.
• No public proof of concept found; this search was not exhaustive.

Our recommendation

• Inventory all Windows 10 1607 and 1809 hosts and check whether they are still in use; prioritise shops, production and kiosk systems.
• Install the fixed builds listed above; for Windows 10 1607 confirm the KB and build on the MSRC page and check the lifecycle status and ESU options with Microsoft.
• Patch current Windows 10 and 11 systems in the regular Patch Tuesday cycle.
• Limit use of the RDP client to trusted destinations and train users not to connect to unknown RDP hosts.
• Monitor for unusual RDP client connections and crashes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69976 msrc.microsoft.com
• CNA record (vulners mirror of cvelist) vulners.com
• NVD record (vulners mirror) vulners.com
• Rapid7 Windows advisory (vulners mirror) vulners.com
• VulDB entry 418293 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:26.