Four Windows Remote Desktop Client flaws can execute code
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
62
CVE-2026-119934
Double free in Microsoft Remote Desktop Client
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A double-free flaw in Microsoft Remote Desktop Client lets an unauthorized attacker execute code over the network. No privileges are required, but the user must interact. Successful exploitation can fully compromise confidentiality, integrity, and availability on affected clients. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-119934. No workaround is named.
| Product | Affected |
|---|---|
| Microsoft Remote Desktop Client | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Double free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-415
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H