Microsoft Remote Desktop Client: Remote code execution via use-after-free

Summary

A use-after-free flaw (CWE-416) in the Remote Desktop Client of Windows allows code execution over the network. Microsoft's CNA record rates it High (CVSS 7.5) with full impact on confidentiality, integrity and availability. Exploitation requires a user to interact with an attacker-controlled RDP endpoint and a high-complexity attack, and no in-the-wild exploitation is known.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (fixed builds per CNA data, see Fixed)
• Windows Server 2012 and 2012 R2 (including Server Core)
• Windows Server 2016

Fixed in

• Windows 10 1607: build 10.0.14393.9612
• Windows 10 1809: build 10.0.17763.9376
• Windows 10 21H2: build 10.0.19044.7807
• Windows 10 22H2: build 10.0.19045.7807
• Windows 11 23H2: build 10.0.22631.7652
• Windows 11 24H2: conflicting data (10.0.26100.9711 or 10.0.26100.33650), verify with MSRC
• Windows 11 25H2 and 26H2: build 10.0.26200.9711 and 10.0.26300.9711 (CNA data)
• Windows 11 26H1: build 10.0.28000.3231
• Patch KBs named by Tenable: KB5126651 (Windows 10 1809 / Server 2019) and KB5126646 (Windows Server 2025), October 2026
• Windows 10 1607 and Windows Server 2012 fixed builds: verify in MSRC, as no fix is confirmed for all entries in the sources

Workaround

• Microsoft's full mitigation text was not retrieved. Per CNA guidance, apply the official update; if it is not yet available, restrict inbound Remote Desktop traffic to trusted sources.
• Block RDP client connections to untrusted hosts via policy until patched.

Exploitation

• Exploited in the wild: no evidence found. CISA KEV: not listed. CISA SSVC: exploitation none, automatable no.
• Public proof-of-concept: none found.
• EPSS 0.00569 (very low).

Our recommendation

• Patch all affected Windows clients and servers with the October 2026 cumulative update, prioritising Windows 10 1607 machines.
• Check whether Windows 10 1607 (Enterprise LTSB 2016) is still supported or covered by ESU; if not, replace or isolate these systems.
• Do not connect to unknown RDP servers and keep RDP off the internet.
• Monitor for unusual RDP client activity and verify the fixed build on each system.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-69987 msrc.microsoft.com
• Vulners: CVELIST CVE-2026-69987 (CNA data) vulners.com
• OpenCVE: CVE-2026-69987 app.opencve.io
• Vulners: NVD CVE-2026-69987 (Tenable KBs, EPSS) vulners.com
• Strix: CVE-2026-69987 www.strix.ai
• VulDB: CVE-2026-69987 (exploit price estimate) vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:24.