High priorityDisclosed

Advisory · CVE-2026-103575

Use-after-free in Remote Desktop Client can run code on connection

The Windows Remote Desktop Client has a use-after-free flaw a remote attacker can use to execute code when a victim connects or interacts. Microsoft rates it CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
Microsoft
Product
Remote Desktop Client
Identifier / CWE
CVE-2026-103575
CWE-416
Action timing
Immediate
ELI5

Explain it like I’m five

Connecting to a hostile RDP server can corrupt the client's own memory, turning the admin's tool against the admin.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker engages the component

    A remote or authorized attacker sends crafted content or requests to Remote Desktop Client.

  2. 02Weakness triggers

    The component mishandles the input and the flaw takes effect.

  3. 03Impact lands

    The attacker gains the execution, elevation, or access the flaw allows.

What happened

Microsoft disclosed CVE-2026-103575 in its October 2026 update guide: a use-after-free weakness (CWE-416) in the Remote Desktop Client lets a remote attacker execute code when a user connects to a malicious server.

Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.

What to do

  1. Inventory every Remote Desktop Client deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to Remote Desktop Client while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for RDP client crashes when connecting to new servers and unexpected processes after RDP sessions.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

Admin workstations again: patch the client and be deliberate about which RDP servers staff connect to.