Remote Desktop Client: Use-after-free leading to remote code execution

Summary

A use-after-free flaw (CWE-416) in the Microsoft Remote Desktop Client, the RDP client component of Windows, allows an unauthorized attacker to execute code over the network. Exploitation requires high attack complexity and user interaction, for example a user connecting to or being directed to a malicious RDP endpoint. The CVSS 3.1 base score is 7.5 (High). The affected and fixed build lists should be verified on the MSRC advisory before patch decisions are made.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Fixed builds per CNA record: Windows 10 1607 10.0.14393.9612; Windows 10 1809 10.0.17763.9376; Windows 10 21H2 10.0.19044.7807; Windows 10 22H2 10.0.19045.7807; Windows 11 23H2 10.0.22631.7652; Windows 11 24H2, 25H2, 26H2 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711; Windows 11 26H1 10.0.28000.3231; Windows Server 2012 6.2.9200.26434; Windows Server 2012 R2 6.3.9600.23470; Windows Server 2016 10.0.14393.9612
• Conflict: OpenCVE lists 10.0.26100.33650 as the fixed build for Windows 11 24H2 and Server 2025. This is unresolved.
• Unknown whether a Windows 10 1607 update is available for this CVE; the related KB numbers are not confirmed.

Workaround

Unknown.

• No vendor or researcher workaround was found. Check the MSRC FAQ and mitigations section.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
• No public proof-of-concept found.
• VulDB estimates a possible exploit price of USD 25k to 100k. This is a broker-price estimate, not evidence of active exploitation.

Our recommendation

• Install the October 2026 security updates on all affected Windows clients and servers as part of the normal patch cycle.
• Give higher priority to Windows 10 1607 systems and to any system where staff connect to external or third-party RDP hosts.
• Verify the fixed builds on the MSRC advisory before rollout.
• Restrict RDP client connections to trusted hosts and do not open RDP files from untrusted sources.
• Check whether Windows 10 1607 is still supported and plan an upgrade if it is not.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69986 msrc.microsoft.com
• CNA JSON record (mirrored on Vulners) vulners.com
• NVD record (mirrored on Vulners) vulners.com
• VulDB entry 418294 vuldb.com
• Strix CVE summary www.strix.ai
• OpenCVE CVE-2026-69986 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:23.