---
id: "CVE-2026-119932"
page: "https://infrastack.ai/live/CVE-2026-119932"
kind: "vulnerability"
aliases: ["CVE-2026-119932"]
title: "Windows Remote Desktop: null pointer flaw lets a network attacker crash service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "windows-server-2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "windows-server-2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "windows-server-2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "windows-server-2016", "fixed": ["10.0.14393.9688"], "affected": ">= 10.0.14393.0, < 10.0.14393.9688", "ecosystem": "vendor"}, {"name": "windows-11-24h2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "windows-11-25h2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "windows-11-23h2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "windows-10-22h2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "windows-app-client", "fixed": ["2.0.1489.0"], "affected": ">= 1.00, < 2.0.1489.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "rdp", "remote-desktop", "windows", "windows-server"]
not_affected_if: []
published_at: "2026-11-10T19:20:15+00:00"
first_seen_at: "2026-11-10T19:25:03+00:00"
updated_at: "2026-11-10T22:21:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119932", "first_seen_at": "2026-11-10T19:25:03+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-119932", "first_seen_at": "2026-11-10T22:21:02+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-119932"]}]
exploit_sources: []
---

# Windows Remote Desktop: null pointer flaw lets a network attacker crash service

Link for people: https://infrastack.ai/live/CVE-2026-119932 (this .md is for agents)

A null pointer dereference in Windows Remote Desktop lets an unauthorized attacker on the network crash the service. The attack causes denial of service; the sources do not say it grants code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:windows-server-2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822
- vendor:windows-server-2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870
- vendor:windows-server-2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487
- vendor:windows-server-2016 affected >= 10.0.14393.0, < 10.0.14393.9688 fixed 10.0.14393.9688
- vendor:windows-11-24h2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974
- vendor:windows-11-25h2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974
- vendor:windows-11-23h2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711
- vendor:windows-10-22h2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846
- vendor:windows-app-client affected >= 1.00, < 2.0.1489.0 fixed 2.0.1489.0

## How to check

Run winver or [System.Environment]::OSVersion.Version / (Get-ComputerInfo).OsBuildNumber on each Windows host and compare the full build (e.g. 10.0.19045.xxxx) with the fixed build for your release. Prioritise hosts with Remote Desktop reachable from the network (TCP 3389). The advisory text read did not say whether RDP must be enabled.

## Fix

Update Windows to a build at or above the fixed build for your release: Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Server 2022 10.0.20348.5870; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2025 10.0.26100.33822; Windows App client 2.0.1489.0. KB numbers not confirmed.

## Timeline

- 2026-11-10T19:25:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119932
- 2026-11-10T22:21:02+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-119932 — Microsoft CNA CVE record (cveawg) gives affected builds and fixed builds; MSRC page is JS-only and unread, so KB numbers and whether RDP must be enabled are unknown. No exploitation or PoC found (CISA SSVC: exploitation none, automatable yes).

## Documents

- [advisory] CVE-2026-119932 CVE record (Microsoft CNA) https://cveawg.mitre.org/api/cve/CVE-2026-119932

## From the sources

Null pointer dereference in Windows Remote Desktop allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_