---
id: "CVE-2026-122166"
page: "https://infrastack.ai/live/CVE-2026-122166"
kind: "vulnerability"
aliases: ["CVE-2026-122166"]
title: "Windows Remote Desktop Services: stack overflow lets a local user gain admin rights"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10/11 and Windows Server", "fixed": [], "affected": "below the per-version fixed builds listed in how-to-check (Windows 10 1607-22H2, Windows 11 23H2-26H2, Server 2016-2025)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "local-privilege-escalation", "remote-desktop-services", "windows", "windows-server"]
not_affected_if: ["remote-desktop-services-disabled"]
published_at: "2026-11-10T19:20:33+00:00"
first_seen_at: "2026-11-10T19:25:10+00:00"
updated_at: "2026-11-10T21:43:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122166", "first_seen_at": "2026-11-10T19:25:10+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-122166", "first_seen_at": "2026-11-10T21:43:18+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-122166"]}]
exploit_sources: []
---

# Windows Remote Desktop Services: stack overflow lets a local user gain admin rights

Link for people: https://infrastack.ai/live/CVE-2026-122166 (this .md is for agents)

Stack-based buffer overflow (CWE-121) in Windows Remote Desktop Services lets an already-authorized local user raise privileges. Microsoft rates it CVSS 7.8 (AV:L, PR:L); published 2026-11-10; not known to be exploited, and exploit code maturity is 'unproven' in the CVE record.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows 10/11 and Windows Server affected below the per-version fixed builds listed in how-to-check (Windows 10 1607-22H2, Windows 11 23H2-26H2, Server 2016-2025) fixed no fixed version listed

## How to check

Run winver or (Get-ComputerInfo).OsBuildNumber and compare the full build with the fixed builds listed in the CVE record: 1607/Server2016 10.0.14393.9688, 1809/Server2019 10.0.17763.9487, 10 21H2 10.0.19044.7846, 10 22H2 10.0.19045.7846, 11 23H2 10.0.22631.7711, 11 24H2 10.0.26100.9974, 11 25H2 10.0.26200.9974, 11 26H1 10.0.28000.3501, 11 26H2 10.0.26300.9974, Server 2022 10.0.20348.5870, Server 2025 10.0.26100.33822. Confirm against the MSRC entry.

## Fix

Install the November 2026 Windows cumulative update that brings the build to at least the fixed build for your version (see how-to-check). KB numbers unconfirmed.

## Timeline

- 2026-11-10T19:25:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122166
- 2026-11-10T21:43:18+00:00 analyst https://app.opencve.io/cve/CVE-2026-122166 — MSRC update guide page is JS-only and returned nothing via web-cli; affected builds taken from OpenCVE mirror of the Microsoft CVE record (not primary), so nothing marked verified. No exploitation or PoC seen (not in KEV, CVSS E:U). Re-check MSRC for KB numbers.

## Documents

- [describes] OpenCVE: CVE-2026-122166 (mirror of Microsoft CVE record) https://app.opencve.io/cve/CVE-2026-122166

## From the sources

Stack-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_