Four Windows Remote Desktop Client flaws can execute code
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
62
CVE-2026-119858
Heap buffer overflow in Microsoft Remote Desktop Client
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A heap-based buffer overflow in Microsoft Remote Desktop Client lets an unauthorized attacker run code over the network. No account is required, but the victim must interact with the attacker and the attack is hard to carry out. Success gives high impact on confidentiality, integrity, and availability of the client. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-119858. Microsoft has not listed a fixed version or workaround.
| Product | Affected |
|---|---|
| Microsoft Remote Desktop Client | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-122, CWE-190
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H