Remote Desktop Client: Use-after-free enables remote code execution

Summary

A use-after-free flaw (CWE-416) in the Remote Desktop Client component of Windows allows an unauthorized attacker to execute code over the network. Exploitation requires high attack complexity and user interaction, for example connecting to a malicious or compromised RDP host. Affected are supported Windows 10, Windows 11 and Windows Server versions listed by the CNA, with CVSS 7.5 (High).

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807; the CNA data contains an inconsistency for this entry)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (6.3.9600.0 to before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• Note: the provided CPE lists only Windows 10 1607; the CNA record lists the products above.

Fixed in

• Install the Microsoft security update of October 2026 (see MSRC advisory for the exact build per product).
• Windows 10 Version 1607: fixed build 10.0.14393.9612 (per CNA data mirror; KB number unknown).
• Windows 10 Version 1809 / Windows Server 2019: KB5126651 (according to Tenable via Vulners).
• Windows Server 2025: KB5126646 (according to Tenable via Vulners).

Workaround

• Disable Remote Desktop on hosts that do not require it.
• Restrict RDP access to known, trusted IP ranges via firewall or network segmentation.
• Blocking inbound TCP 3389 on servers does not protect a vulnerable client that connects outward to a malicious host; patching is the main control.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV.
• EPSS about 0.57%.
• No public proof of concept found in the research; this means not known, not confirmed absent.

Our recommendation

• Apply the October 2026 Microsoft update on all Windows workstations and servers, including Windows 10 1607 if still in use.
• Check the MSRC table for the exact fixed build of each product.
• Replace unsupported Windows 10 1607 systems and verify their lifecycle status with Microsoft.
• Prioritize workstations and admin jump hosts with unpatched RDP clients.
• Restrict RDP to trusted networks and warn users not to open unknown .rdp files or connect to unknown hosts.
• Monitor for unusual RDP connections and crashes of the mstsc process.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70006 msrc.microsoft.com
• OpenCVE: CVE-2026-70006 app.opencve.io
• Vulners (NVD): CVE-2026-70006 vulners.com
• Vulners (CVE List mirror): CVE-2026-70006 vulners.com
• Strix: CVE-2026-70006 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:14.