Remote Desktop Client: Use after free allows remote code execution

Summary

A use-after-free vulnerability (CWE-416) in the Windows Remote Desktop Client allows an unauthorized attacker to execute code over the network. Exploitation requires high attack complexity and user interaction, for example connecting to a malicious or spoofed RDP host. The CVSS 3.1 base score is 7.5 (High). Many Windows 10, Windows 11 and Windows Server versions are affected.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to below 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to below 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to below 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to below 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to below 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to below 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to below 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to below 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to below 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to below 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to below 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to below 10.0.14393.9612

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711 (one source lists 10.0.26100.33650 for 24H2; verify on MSRC)
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• Verify all build numbers and update names on the MSRC advisory before deployment.

Workaround

Unknown. No vendor workaround or mitigation was found in the sources.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof-of-concept exploit found.
• No known exploitation in the wild in the sources reviewed; CISA KEV listing not verified.
• EPSS score 0.00569 (about 0.6 percent probability of exploitation within 30 days).

Our recommendation

• Inventory all Windows clients and servers with the Remote Desktop Client, including Windows 10 1607 and Windows Server 2012 hosts.
• Install the October 2026 security updates on Windows 10 and 11 clients first, especially admin workstations and jump hosts.
• Patch servers that accept RDP connections next.
• Check whether Windows 10 1607 and Windows Server 2012 still receive security updates (support or ESU); replace systems that no longer receive patches.
• Restrict outbound RDP connections to trusted hosts and limit who can start RDP sessions until patching is complete (not verified against Microsoft guidance).
• Monitor for a CISA KEV listing or public exploit code and accelerate patching if either appears.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (advisory, not fetched) msrc.microsoft.com
• NVD mirror (Vulners): versions, EPSS, update names vulners.com
• CNA record (Vulners CVEList) vulners.com
• OpenCVE (conflicting build number) app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:13.