Four Windows Remote Desktop Client flaws can execute code
Original title: Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network
The highest score is 8.8 for a double-free; one bug needs only local low privileges, not a network connection.
Microsoft published updates on November 10, 2026, for four Windows Remote Desktop Client vulnerabilities involving memory errors and a race condition. Three can be reached over the network if a user connects to a malicious server; CVE-2026-119390 is a local heap overflow needing low privileges and no extra interaction. Microsoft reported no exploitation at publication for CVE-2026-119934, CVE-2026-119390, and CVE-2026-95964. Windows App Client for Windows Desktop is fixed at version 2.0.1489.0 for CVE-2026-119390.
Unconfirmed: The article does not say whether CVE-2026-119858 has been exploited.
- CVE-2026-119934 is a double-free rated 8.8 and needs a connection to a malicious server.
- CVE-2026-119858 is a heap overflow whose exploitation depends on specific protocol settings.
- CVE-2026-95964 is a race condition rated 7.5 that Microsoft calls unlikely to exploit.
- Affected systems include Windows 10, Windows 11, and Windows Server releases.
Impact: Remote or local code execution in Remote Desktop Client
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows Remote Desktop Client | Windows 10, Windows 11, and Windows Server releases | — |
| Microsoft Windows App Client for Windows Desktop | — | 2.0.1489.0 |
- 1.Deploy the matching updates and verify them on devices that make Remote Desktop connections.
- 2.Check each vulnerability’s product table rather than assuming one update covers every system.
- ATT&CK
- T1204 User Execution
- Vendors
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-119934+3 related CVEs | Double free in Microsoft Remote Desktop Client | 8.8 group max | — |
From the original article
3 min read at cybersecuritynews.com
Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities that could allow attackers to run code through network connections or local access. Published on November 10, 2026, the flaws involve memory handling errors and a race condition. Three have network attack paths, while the fourth requires an attacker with existing local access, […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.