---
id: "CVE-2026-119957"
page: "https://infrastack.ai/live/CVE-2026-119957"
kind: "vulnerability"
aliases: ["CVE-2026-119957"]
title: "Windows Remote Desktop Services: double free lets a local user gain privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows Remote Desktop Services", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "remote-desktop-services", "windows", "windows-server"]
not_affected_if: ["rds-not-in-use"]
published_at: "2026-11-10T19:20:19+00:00"
first_seen_at: "2026-11-10T19:25:05+00:00"
updated_at: "2026-11-10T19:40:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119957", "first_seen_at": "2026-11-10T19:25:05+00:00"}]
exploit_sources: []
---

# Windows Remote Desktop Services: double free lets a local user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-119957 (this .md is for agents)

A double free bug in Windows Remote Desktop Services lets an attacker who already has an account on the machine raise their privileges. Successful exploitation gives the attacker higher rights than they were granted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows Remote Desktop Services affected range not listed fixed no fixed version listed

## How to check

- Check the installed Windows build with `winver` and compare it with the fixed build in Microsoft's advisory for CVE-2026-119957
- Confirm whether the Remote Desktop Services role is installed or Remote Desktop is enabled on the machine

## Timeline

- 2026-11-10T19:25:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119957

## From the sources

Double free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_