--- id: "CVE-2026-119858" page: "https://infrastack.ai/live/CVE-2026-119858" kind: "vulnerability" aliases: ["CVE-2026-119858"] title: "Windows Remote Desktop Client: heap overflow lets an attacker run code over the network (needs user interaction)" severity: "high" cvss: 7.5 epss: null exploited: false status: "open" category: "other" products: [{"name": "Windows 10 1607 / Server 2016", "fixed": ["10.0.14393.9688"], "affected": "< 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": "< 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": "< 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": "< 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2 / Server 2025 (24H2 line)", "fixed": ["10.0.26100.9974", "10.0.26100.33822"], "affected": "Win11 24H2 < 10.0.26100.9974; Server 2025 < 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": "< 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": "< 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": "< 10.0.26300.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": "< 10.0.20348.5870", "ecosystem": "vendor"}] ecosystems: [] tags: ["microsoft", "other", "rdp", "remote-desktop-client", "windows", "windows-server"] not_affected_if: ["patched-build"] published_at: "2026-11-10T19:20:03+00:00" first_seen_at: "2026-11-10T19:24:59+00:00" updated_at: "2026-11-10T22:47:01+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119858", "first_seen_at": "2026-11-10T19:24:59+00:00"}, {"source": "analyst", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858", "first_seen_at": "2026-11-10T22:47:01+00:00", "cites": ["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858", "https://app.opencve.io/cve/CVE-2026-119858"]}] exploit_sources: [] --- # Windows Remote Desktop Client: heap overflow lets an attacker run code over the network (needs user interaction) Link for people: https://infrastack.ai/live/CVE-2026-119858 (this .md is for agents) Microsoft lists a heap-based buffer overflow in the Remote Desktop Client (CWE-122, with an integer overflow, CWE-190) that lets an unauthenticated attacker run code over a network. CVSS 7.5 (high complexity, user interaction required). Not exploited and no public PoC were found as of publication; the CVE record marks exploit code as unproven. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Windows 10 1607 / Server 2016 affected < 10.0.14393.9688 fixed 10.0.14393.9688 - vendor:Windows 10 1809 / Server 2019 affected < 10.0.17763.9487 fixed 10.0.17763.9487 - vendor:Windows 10 21H2 affected < 10.0.19044.7846 fixed 10.0.19044.7846 - vendor:Windows 10 22H2 affected < 10.0.19045.7846 fixed 10.0.19045.7846 - vendor:Windows 11 23H2 affected < 10.0.22631.7711 fixed 10.0.22631.7711 - vendor:Windows 11 24H2 / Server 2025 (24H2 line) affected Win11 24H2 < 10.0.26100.9974; Server 2025 < 10.0.26100.33822 fixed 10.0.26100.9974, 10.0.26100.33822 - vendor:Windows 11 25H2 affected < 10.0.26200.9974 fixed 10.0.26200.9974 - vendor:Windows 11 26H1 affected < 10.0.28000.3501 fixed 10.0.28000.3501 - vendor:Windows 11 26H2 affected < 10.0.26300.9974 fixed 10.0.26300.9974 - vendor:Windows Server 2022 affected < 10.0.20348.5870 fixed 10.0.20348.5870 ## How to check Run 'winver' or PowerShell '[System.Environment]::OSVersion.Version' and compare the full build (e.g. 10.0.26100.x) with the fixed build for your Windows version. Anything lower is affected. Not confirmed from Microsoft's own page: the MSRC page is JavaScript-only and could not be read; the data comes from a mirror of Microsoft's CVE record. ## Fix Install the November 2026 Microsoft cumulative update for your Windows version. Fixed builds per the Microsoft CNA record: Win10 1607/Server 2016 10.0.14393.9688; Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. ## Timeline - 2026-11-10T19:24:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119858 - 2026-11-10T22:47:01+00:00 analyst https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858 — Microsoft CNA record (via OpenCVE mirror; MSRC page JS-only, unreadable) gives affected Windows builds and fixed builds. Nothing verified. No exploitation or PoC found; did not search social. Revisit when MSRC text is readable to confirm attack path. ## Documents - [advisory] MSRC: CVE-2026-119858 Remote Desktop Client Remote Code Execution Vulnerability (page is JS-only; content not readable) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858 - [describes] OpenCVE mirror of Microsoft CNA record for CVE-2026-119858 https://app.opencve.io/cve/CVE-2026-119858 ## From the sources Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_