Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network

Microsoft has released security updates for four Windows Remote Desktop Client vulnerabilities that could allow attackers to run code through network connections or local access.

Published on November 10, 2026, the flaws involve memory handling errors and a race condition. Three have network attack paths, while the fourth requires an attacker with existing local access, an important difference when assessing exposure.

The highest-scoring flaw, CVE-2026-119934, carries a CVSS score of 8.8 and an Important severity rating. Microsoft describes it as a double-free bug, meaning the client releases the same memory area more than once. This can damage memory handling and allow an attacker to run code when the affected client processes a response from a malicious server.

An attacker would need to host that server and persuade a user to connect. No prior account access is required, but user interaction is necessary. This is not an attack where someone can simply send traffic to any Windows computer and gain control. The exposed component is the connecting Remote Desktop client, making the choice of remote server central to this attack path.

CVE-2026-119858 involves a heap-based buffer overflow that allows an unauthorized attacker to execute code over a network. The flaw concerns data exceeding the space reserved for it in memory.

Microsoft’s advisory says exploitation depends on specific conditions, such as protocol settings or configurations. Those requirements limit the likelihood of broad attacks, but do not remove the need to update affected clients.

The race condition, CVE-2026-95964, has a CVSS score of 7.5. It affects how client operations share a resource without proper synchronization. Successful exploitation requires winning a race condition, where operations occur in a particular order or timing. Microsoft lists user interaction as required and rates exploitation as unlikely, reflecting the added difficulty of reliably triggering this network code execution flaw.

Remote Desktop Client Attack Conditions

The fourth issue, CVE-2026-119390, needs separate treatment despite its Remote Code Execution title. Microsoft’s technical description identifies a local heap-based buffer overflow requiring low privileges, with no additional user interaction. Its CVSS score is 7.8. Reporting it as an unauthenticated network attack would therefore misstate the access needed to exploit it.

Client-side attacks are an established concern. Cyber Security News previously covered a Remote Desktop Client vulnerability involving a malicious server and a different underlying weakness. That earlier case provides useful context, but it is not evidence that the newly disclosed flaws share its attack method or have already been used against organizations.

Social engineering also makes the connection step relevant. Previous rogue RDP phishing campaigns used emailed connection files to direct victims toward attacker-controlled servers. Those campaigns abused remote resource sharing rather than these new memory flaws. The connection is practical, not proof of a shared campaign: attackers already have methods for persuading users to open unwanted remote sessions.

Affected Windows Systems

Microsoft’s CVE-2026-119934 advisory lists affected Windows 10, Windows 11, and Windows Server releases. Administrators should check each vulnerability’s product table rather than assume one update covers every installation. The CVE-2026-119390 table also includes Windows App Client for Windows Desktop, with version 2.0.1489.0 listed as the fixed build for that product.

Security teams should deploy the matching updates and verify installation across employee devices and administrative systems that make Remote Desktop connections. Microsoft reported no exploitation at publication for CVE-2026-119934, CVE-2026-119390, and CVE-2026-95964.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network appeared first on Cyber Security News.