Microsoft Remote Desktop Client: Use-after-free allows remote code execution

Summary

A use-after-free flaw (CWE-416) in the Windows Remote Desktop Client allows an unauthorized attacker to execute code over the network. The attack requires high complexity and user interaction, for example a user connecting to a host controlled by the attacker. The CVSS 3.1 base score is 7.5 and no exploitation is known.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2: affected per CNA record, exact fixed builds conflict between sources
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows 11: Unknown (sources conflict, verify with the MSRC advisory)

Workaround

No workaround is documented in the sources available.

• Only connect to RDP hosts you trust.
• Do not open RDP files or links from unknown senders.
• Restrict RDP access to a VPN or gateway.

Exploitation

• No known exploitation.
• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found.

Our recommendation

• Install the Microsoft security update on all affected Windows systems, starting with Windows 10 Version 1607 and 1809 hosts and workstations used for RDP.
• Check whether Windows 10 Version 1607 still receives security updates or only Extended Security Updates, and plan an upgrade if needed.
• Verify the fixed build numbers in the MSRC advisory before relying on them.
• Check whether MSRDC-based clients in your environment need updating as well.
• Restrict RDP exposure and monitor for unusual RDP connections.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory msrc.microsoft.com
• NVD record via Vulners vulners.com
• CNA record (version ranges) via Vulners vulners.com
• OpenCVE (KEV, SSVC, guidance) app.opencve.io
• Strix CVE summary www.strix.ai
• VulDB entry vuldb.com
• Related MSRDC fix (WSL pull request) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:23.