Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network

Microsoft disclosed four Remote Desktop Client vulnerabilities, three of which can be exploited entirely over the network without requiring local access, making them particularly dangerous for any internet-exposed or internally accessible Windows environment. The most severe flaw (CVE-2026-119934, CVSS 8.8) is a double-free memory corruption bug, alongside heap-based buffer overflows and a race condition — all classes of vulnerability that arise from unsafe memory management in widely deployed software. Because RDP is one of the most commonly exposed services in enterprise environments, unpatched systems present a high-value target for ransomware operators and state-sponsored attackers alike. Delayed patching of network-reachable code execution flaws dramatically increases the window of exposure and the likelihood of successful compromise.