Microsoft Remote Desktop Client: Remote code execution due to use after free

Summary

A use-after-free weakness (CWE-416) in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. Exploitation requires user interaction, for example connecting to a malicious or spoofed RDP host, and the attack complexity is high. CISA SSVC rates exploitation as none, and no public exploit was found in the research.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 line: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: 10.0.26100.0 and 10.0.26200.0 to below 10.0.26100.9711 and 10.0.26200.9711 (per CNA record, unresolved in other sources)
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012: 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.0 to below 6.3.9600.23470

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9612
• Windows 10 1809: 10.0.17763.9376
• Windows 10 21H2: 10.0.19044.7807
• Windows 10 22H2: 10.0.19045.7807
• Windows 11 23H2: 10.0.22631.7652
• Windows 11 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Windows 11 24H2, 25H2, 26H2: confirm the build in the MSRC table, as sources conflict
• Patch KB for Windows 10 1607: Unknown.

Workaround

Unknown.

• Microsoft provides a patch; no MSRC-specific workaround was confirmed.
• Generic measure: disable Remote Desktop on systems where it is not required.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV
• EPSS 0.00569 (very low)
• No public proof of concept found; absence in searches is not proof that none exists

Our recommendation

• Inventory Windows 10 1607 and 1809 systems first; 1607 may be out of support, so verify Microsoft's lifecycle page.
• Install the October 2026 cumulative update on all supported systems and confirm the fixed build in the MSRC table.
• Restrict RDP client use to known hosts where feasible and instruct users not to connect to unknown RDP hosts.
• Check CVE-2026-69992 (Windows Remote Desktop Services) for RDP servers and re-check KEV and PoC status regularly.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69991 msrc.microsoft.com
• Vulners CVE record (CNA data): CVE-2026-69991 vulners.com
• Vulners NVD mirror: CVE-2026-69991 vulners.com
• OpenCVE: CVE-2026-69991 app.opencve.io
• Strix: CVE-2026-69991 www.strix.ai
• Strix: CVE-2026-69992 (related RDP CVE) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:25.