Windows Remote Desktop Client: Heap-based buffer overflow allows code execution
Summary
A heap-based buffer overflow in the Remote Desktop Client of Windows allows an unauthorized attacker to execute code over the network. User interaction is required, for example a user connecting a client to a malicious or compromised RDP host. Windows 10 version 1607 (LTSB 2016) reached end of updates on October 13, 2026, so the October 2026 update is its last regular fix and future RDP client flaws will remain unpatched.
Affected
- Windows 10 Version 1607 (Enterprise LTSB 2016 and IoT Enterprise LTSB 2016): builds below 10.0.14393.9612
- Other affected versions listed by Microsoft include Windows 10 1809, 21H2, 22H2, Windows 11 23H2 to 26H2, and Windows Server 2012, 2012 R2 and 2016
Fixed in
- Windows 10 1607: build 10.0.14393.9612 or later (per aggregator data, confirm in the MSRC advisory). KB number: Unknown.
- The fix is included in the October 2026 security update.
Workaround
Unknown. Microsoft published no workarounds or mitigations. Practical measures are upgrading, ESU enrolment and network restrictions.
Exploitation
- MSRC marks the flaw as Exploited: No.
- CISA SSVC: exploitation none, automatable no.
- Public proof of concept: none found in research; not checked exhaustively.
Our recommendation
- Identify all Windows 10 1607 hosts, including OT, kiosk and point-of-sale devices.
- Plan migration to a supported version, for example Windows 11 Enterprise LTSC 2024.
- If migration is not possible in time, evaluate ESU enrolment and install the October 2026 update.
- Restrict outbound RDP to approved hosts and block inbound RDP at the perimeter.
- Segment these devices from the internet and the general office network.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Remote Desktop Client
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-83688 msrc.microsoft.com
- Microsoft: Windows 10 1607 and Windows Server 2016 release health status learn.microsoft.com
- Microsoft: Windows message center learn.microsoft.com
- Vulners MSCVE feed: MS:CVE-2026-83688 vulners.com
- OpenCVE: CVE-2026-83688 app.opencve.io
- Computerworld: October 2026 Patch Tuesday www.computerworld.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:36.
Original description (NVD)
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.