Four Windows Remote Desktop Client flaws can execute code
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
62
CVE-2026-119390
Heap buffer overflow in Remote Desktop Client (local, authenticated)
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow in Microsoft Remote Desktop Client lets an attacker who already has a local account run code on the machine. No user interaction is required. Successful exploitation can give full control of confidentiality, integrity, and availability in the same security context. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-119390. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Remote Desktop Client | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code locally.
- Weakness
- CWE-122
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H