{"id":"CVE-2026-119858","kind":"vulnerability","aliases":["CVE-2026-119858"],"related":[],"title":"Windows Remote Desktop Client: heap overflow lets an attacker run code over the network (needs user interaction)","description":"Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.","summary":"Microsoft lists a heap-based buffer overflow in the Remote Desktop Client (CWE-122, with an integer overflow, CWE-190) that lets an unauthenticated attacker run code over a network. CVSS 7.5 (high complexity, user interaction required). Not exploited and no public PoC were found as of publication; the CVE record marks exploit code as unproven.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1607 / Server 2016","fixed":["10.0.14393.9688"],"affected":"< 10.0.14393.9688","ecosystem":"vendor"},{"name":"Windows 10 1809 / Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 24H2 / Server 2025 (24H2 line)","fixed":["10.0.26100.9974","10.0.26100.33822"],"affected":"Win11 24H2 < 10.0.26100.9974; Server 2025 < 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"}],"ecosystems":[],"tags":["microsoft","other","rdp","remote-desktop-client","windows","windows-server"],"not_affected_if":["patched-build"],"how_to_check":"Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the full build (e.g. 10.0.26100.x) with the fixed build for your Windows version. Anything lower is affected. Not confirmed from Microsoft's own page: the MSRC page is JavaScript-only and could not be read; the data comes from a mirror of Microsoft's CVE record.","fix":"Install the November 2026 Microsoft cumulative update for your Windows version. Fixed builds per the Microsoft CNA record: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822.","status":"open","published_at":"2026-11-10T19:20:03+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:44:34+00:00","updated_at":"2026-11-10T22:47:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:44:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Remote Desktop Client: heap overflow lets a network attacker run code","impact":"high","summary":"A heap-based buffer overflow in the Remote Desktop Client lets an unauthorized attacker reach it over the network. The sources say this can lead to code execution on the affected machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["remote-desktop-client"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"code runs on the client machine via network","analyst_note":"Identify the vendor and affected Remote Desktop Client versions, and check the NVD entry for the fix and configuration details.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000617,"input_tokens":4494,"output_tokens":336,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the vendor and affected Remote Desktop Client versions, and check the NVD entry for the fix and configuration details.","search":"'-119858':20A,23A '-122':87B '-190':93B '-2026':19A,22A '10':25A,30A,35A,38A '11':41A,44A,51A,54A,57A '1607':26A '1809':31A '2016':28A '2019':33A '2022':61A '2025':47A '21h2':36A '22h2':39A '23h2':42A '24h2':45A,48A '25h2':52A '26h1':55A '26h2':58A '7.5':105B 'allow':139C 'attack':9A,98B,142C 'base':78B,132C 'buffer':79B,133C 'client':4A,68B,85B,138C 'code':11A,100B,127B,145C 'complex':107B 'cve':18A,21A,123B 'cvss':104B 'cwe':86B,92B 'desktop':3A,67B,84B,137C 'execut':144C 'exploit':112B,126B 'found':118B 'heap':5A,77B,131C 'heap-bas':76B,130C 'high':106B 'integ':90B 'interact':17A,109B 'let':7A,95B 'line':49A 'list':74B 'mark':125B 'microsoft':62B,73B 'need':15A 'network':14A,103B,148C 'overflow':6A,80B,91B,134C 'poc':116B 'public':115B,121B 'rdp':64B 'record':124B 'remot':2A,66B,83B,136C 'remote-desktop-cli':65B 'requir':110B 'run':10A,99B 'server':27A,32A,46A,60A,72B 'unauthent':97B 'unauthor':141C 'unproven':129B 'user':16A,108B 'window':1A,69B,71B 'windows':24A,29A,34A,37A,40A,43A,50A,53A,56A,59A 'windows-serv':70B","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607 to 22H2), Windows 11 (23H2 to 26H2) and Windows Server 2016, 2019, 2022 and 2025 below the fixed builds are listed. The user interaction in the CVSS vector suggests a user connecting to a malicious or attacker-controlled RDP server or opening a crafted connection file is the likely path, but Microsoft's text was not readable, so that is inferred. Systems that never use the Remote Desktop client can lower priority but should still patch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101607server2016","101809server2019","1021h2","1022h2","1123h2","1124h2server202524h2line","1125h2","1126h1","1126h2","server2022","windows101607server2016","windows101809server2019","windows1021h2","windows1022h2","windows1123h2","windows1124h2server202524h2line","windows1125h2","windows1126h1","windows1126h2","windowsserver2022"],"ptokens":["10","11","1607","1809","2016","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","line","server","windows"],"labels":["high","microsoft","other","rdp","remotedesktopclient","windows","windowsserver"],"campaign_type":null,"search_a":"'-119858':20A,23A '-2026':19A,22A '10':25A,30A,35A,38A '11':41A,44A,51A,54A,57A '1607':26A '1809':31A '2016':28A '2019':33A '2022':61A '2025':47A '21h2':36A '22h2':39A '23h2':42A '24h2':45A,48A '25h2':52A '26h1':55A '26h2':58A 'attack':9A 'client':4A 'code':11A 'cve':18A,21A 'desktop':3A 'heap':5A 'interact':17A 'let':7A 'line':49A 'need':15A 'network':14A 'overflow':6A 'remot':2A 'run':10A 'server':27A,32A,46A,60A 'user':16A 'window':1A 'windows':24A,29A,34A,37A,40A,43A,50A,53A,56A,59A","search_b":"'-122':87B '-190':93B '7.5':105B 'attack':98B 'base':78B 'buffer':79B 'client':68B,85B 'code':100B,127B 'complex':107B 'cve':123B 'cvss':104B 'cwe':86B,92B 'desktop':67B,84B 'exploit':112B,126B 'found':118B 'heap':77B 'heap-bas':76B 'high':106B 'integ':90B 'interact':109B 'let':95B 'list':74B 'mark':125B 'microsoft':62B,73B 'network':103B 'overflow':80B,91B 'poc':116B 'public':115B,121B 'rdp':64B 'record':124B 'remot':66B,83B 'remote-desktop-cli':65B 'requir':110B 'run':99B 'server':72B 'unauthent':97B 'unproven':129B 'user':108B 'window':69B,71B 'windows-serv':70B","search_c":"'allow':139C 'attack':142C 'base':132C 'buffer':133C 'client':138C 'code':145C 'desktop':137C 'execut':144C 'heap':131C 'heap-bas':130C 'network':148C 'overflow':134C 'remot':136C 'unauthor':141C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119858","severity":null,"published_at":"2026-11-10T19:20:03+00:00","modified_at":"2026-11-10T19:20:04+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119858:3041","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858","severity":null,"published_at":"2026-11-10T22:47:01+00:00","modified_at":"2026-11-10T22:47:01+00:00","first_seen_at":"2026-11-10T22:47:01+00:00","fetched_at":"2026-11-10T22:47:01+00:00","note":"Microsoft CNA record (via OpenCVE mirror; MSRC page JS-only, unreadable) gives affected Windows builds and fixed builds. Nothing verified. No exploitation or PoC found; did not search social. Revisit when MSRC text is readable to confirm attack path.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858","https://app.opencve.io/cve/CVE-2026-119858"]}],"documents":[{"id":119732,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858","title":"MSRC: CVE-2026-119858 Remote Desktop Client Remote Code Execution Vulnerability (page is JS-only; content not readable)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":119733,"url":"https://app.opencve.io/cve/CVE-2026-119858","title":"OpenCVE mirror of Microsoft CNA record for CVE-2026-119858","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}