Four Windows Remote Desktop Client flaws can execute code
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
62
CVE-2026-95964
Race condition RCE in Microsoft Remote Desktop Client
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A race condition in Microsoft Remote Desktop Client lets an unauthorized attacker run code over the network. Triggering it requires user interaction and is difficult to exploit reliably. Successful exploitation can fully compromise confidentiality, integrity, and availability of the client. Microsoft has not listed affected builds or a fixed version.
What to do: Apply Microsoft's update for CVE-2026-95964. Microsoft has not listed a fixed version or workaround.
| Product | Affected |
|---|---|
| Microsoft Remote Desktop Client | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- Weakness
- CWE-362
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H