Multiple Windows Remote Desktop Client Vulnerabilities Allow Code Execution (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5807 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5807 Suspicious Child Process Spawned by mstsc.exe (Post-Exploitation of RDP Client Memory Corruption)

Detects shells, script hosts and living-off-the-land binaries launched as children of mstsc.exe. The Remote Desktop Client does not normally spawn these, so a hit after a connection to an untrusted server is a strong indicator that CVE-2026-119934, CVE-2026-119858, CVE-2026-95964 or CVE-2026-119390 achieved code execution in the client process.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1203, T1059, T1059.001, T1059.003, T1218, T1105
• Data sources: sysmon, microsoft_defender_xdr:DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\mstsc.exe" earliest=-24h (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe" OR Image="*\\wmic.exe" OR Image="*\\curl.exe" OR Image="*\\schtasks.exe")
| stats count AS child_launches min(_time) AS first_seen values(CommandLine) AS child_commands values(IntegrityLevel) AS integrity by host User ParentCommandLine Image
| table first_seen host User ParentCommandLine Image child_commands integrity child_launches

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'mstsc.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe', 'msiexec.exe', 'wmic.exe', 'curl.exe', 'schtasks.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName

Sigma

title: Suspicious Child Process of mstsc.exe (TL-2026-5807)
id: 2f9d6b84-1a7c-4e35-8c40-b6e7d2a90f02
status: experimental
description: Detects shells, script hosts and LOLBins spawned by the Remote Desktop Client, indicating possible code execution via CVE-2026-119934, CVE-2026-119858, CVE-2026-95964 or CVE-2026-119390.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119934
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119858
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119390
    - https://nvd.nist.gov/vuln/detail/CVE-2026-95964
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - attack.defense-evasion
    - attack.t1218
    - attack.command-and-control
    - attack.t1105
    - cve.2026.119934
    - cve.2026.119858
    - cve.2026.119390
    - cve.2026.95964
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\mstsc.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
            - '\wmic.exe'
            - '\curl.exe'
            - '\schtasks.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Custom RDP launcher wrappers that start mstsc.exe and run helper commands under it
level: high

Known false positives:

• Custom helper tooling that launches child processes from within mstsc.exe

Tuning notes: mstsc.exe has no routine reason to spawn these binaries, so keep the list tight and alert on any hit. Add names of Windows App / msrdc client processes to the parent filter once their binary names are confirmed in your estate. Exclude WerFault.exe (crash handler) if you broaden the child list.

• 🔒 TL-2026-5807 mstsc.exe Application Crash with Memory-Corruption Exception Code · unlock with TL Creds
• 🔒 TL-2026-5807 .rdp File Written to User-Writable Path Then Opened by mstsc.exe · unlock with TL Creds
• 🔒 TL-2026-5807 Elevated Child Process of Lower-Integrity mstsc.exe (CVE-2026-119390 Local Privilege Abuse) · unlock with TL Creds
• 🔒 TL-2026-5807 mstsc.exe Opening .rdp File Launched from Email Client, Browser, Archiver or Office · unlock with TL Creds
• 🔒 TL-2026-5807 Unpatched Windows Remote Desktop Client (mstsc.exe) Executed on Vulnerable Build · unlock with TL Creds
• 🔒 TL-2026-5807 mstsc.exe Launched with /v Target by Script Host or Shell Parent · unlock with TL Creds
• 🔒 TL-2026-5807 mstsc.exe Launched Against Public RDP Server or Untrusted .rdp File (CVE-2026-119934 Trigger) · unlock with TL Creds
• 🔒 TL-2026-5807 Outbound RDP Connection from mstsc.exe to Non-Private Address · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5807.

Technical analysis

On 2026-11-10 Microsoft published fixes and CVE records for four vulnerabilities in the Windows Remote Desktop Client. All four are rated High by Microsoft (as CNA) and remain 'Awaiting Analysis' at NVD.

CVE-2026-119934 (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-415 Double Free): the client releases the same memory twice. A malicious RDP server can send a crafted response that triggers the double free and yields code execution on the connecting client. The attacker must operate (or compromise) the server and induce a user to connect; no prior access to the victim is needed, but user interaction is required.

CVE-2026-119858 (CVSS 7.5, AV:N/AC:H/PR:N/UI:R, CWE-122 heap-based buffer overflow and CWE-190 integer overflow): data exceeding the reserved heap allocation enables remote code execution over the network; per the reporting, exploitation depends on specific protocol settings or configurations. CVE-2026-95964 (CVSS 7.5, AV:N/AC:H/PR:N/UI:R, CWE-362 race condition): improper synchronization of a shared resource allows code execution if the attacker wins the race; user interaction is required and Microsoft rates exploitation as unlikely. CVE-2026-119390 (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, CWE-122): a local heap-based buffer overflow allowing an authorized low-privileged local attacker to execute code; it is not a network attack despite the 'RCE' framing in some coverage, and it also affects Windows App Client for Windows Desktop (fixed in 2.0.1489.0).

Affected: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 below the fixed builds listed in affected_json. Microsoft reported no exploitation for CVE-2026-119934, CVE-2026-119390 and CVE-2026-95964; the exploitation status of CVE-2026-119858 was not stated in the sourced coverage. No public PoC, threat actor attribution or network IOCs were identified in the sources. Detection should focus on the RDP client (mstsc.exe) connecting to untrusted servers or opening untrusted .rdp files, client crashes, and child-process anomalies; patch verification is the primary control. Note: the MSRC advisory pages could not be rendered, so CVSS/CWE/build data come from the NVD records; KB numbers were not retrievable.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Desktop Protocol

Execution

T1203 Exploitation for Client Execution; T1204 User Execution

Remediation

Patches

• Windows 10 1607/Server 2016: build 10.0.14393.9688
• Windows 10 1809/Server 2019: build 10.0.17763.9487
• Windows 10 21H2: 10.0.19044.7846; Windows 10 22H2: 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711; 24H2: 10.0.26100.9974; 25H2: 10.0.26200.9974; 26H1: 10.0.28000.3501; 26H2: 10.0.26300.9974
• Windows Server 2022: 10.0.20348.5870; Windows Server 2025: 10.0.26100.33822
• Windows App Client for Windows Desktop: 2.0.1489.0

Immediate actions

• Deploy the November 2026 Microsoft security updates to all Windows 10/11 and Windows Server systems that run the Remote Desktop Client
• Update Windows App Client for Windows Desktop to 2.0.1489.0 or later (CVE-2026-119390)
• Verify patch installation on employee devices and administrative/jump systems that make outbound RDP connections
• Instruct users to connect only to trusted, known RDP servers and not to open unsolicited .rdp files

Workarounds

• No vendor workaround was identified in the sources; limit connections to trusted RDP servers until patched

Longer-term hardening

• Restrict outbound RDP (TCP/UDP 3389) from workstations to approved servers or gateways
• Monitor mstsc.exe for crashes and anomalous child processes
• Maintain asset inventory with build-level visibility of RDP client versions

Affected and fixed versions

• Microsoft — Windows 10 (Remote Desktop Client)
  Vulnerable versions: 1607 < 10.0.14393.9688; 1809 < 10.0.17763.9487; 21H2 < 10.0.19044.7846; 22H2 < 10.0.19045.7846
  Fixed in: 10.0.14393.9688; 10.0.17763.9487; 10.0.19044.7846; 10.0.19045.7846
• Microsoft — Windows 11 (Remote Desktop Client)
  Vulnerable versions: 23H2 < 10.0.22631.7711; 24H2 < 10.0.26100.9974; 25H2 < 10.0.26200.9974; 26H1 < 10.0.28000.3501; 26H2 < 10.0.26300.9974
  Fixed in: 10.0.22631.7711; 10.0.26100.9974; 10.0.26200.9974; 10.0.28000.3501; 10.0.26300.9974
• Microsoft — Windows Server (Remote Desktop Client)
  Vulnerable versions: 2016 < 10.0.14393.9688; 2019 < 10.0.17763.9487; 2022 < 10.0.20348.5870; 2025 < 10.0.26100.33822
  Fixed in: 10.0.14393.9688; 10.0.17763.9487; 10.0.20348.5870; 10.0.26100.33822
• Microsoft — Windows App Client for Windows Desktop (CVE-2026-119390 only)
  Vulnerable versions: < 2.0.1489.0
  Fixed in: 2.0.1489.0

Timeline

• 2026-11-10 Microsoft reports no exploitation at publication for CVE-2026-119934, CVE-2026-119390 and CVE-2026-95964; status of CVE-2026-119858 not stated
• 2026-11-10 CVE-2026-119390 (local heap overflow, CVSS 7.8) published; fixed Windows App Client build 2.0.1489.0
• 2026-11-10 CVE-2026-95964 (race condition, CVSS 7.5) published to NVD (19:21 UTC); Microsoft rates exploitation unlikely
• 2026-11-10 CVE-2026-119934 (double free, CVSS 8.8) published to NVD (19:20 UTC); awaiting analysis
• 2026-11-10 CVE-2026-119858 (heap/integer overflow, CVSS 7.5) published to NVD (19:20 UTC)
• 2026-11-10 Microsoft releases security updates for the Remote Desktop Client fixing CVE-2026-119934, CVE-2026-119858, CVE-2026-119390 and CVE-2026-95964
• 2026-11-11 Cyber Security News publishes analysis of the four Remote Desktop Client flaws

Sources cited

• NVD - CVE-2026-119934 NVD (NIST) · Advisory · 2026-11-10
• NVD - CVE-2026-119858 NVD (NIST) · Advisory · 2026-11-10
• NVD - CVE-2026-119390 NVD (NIST) · Advisory · 2026-11-10
• NVD - CVE-2026-95964 NVD (NIST) · Advisory · 2026-11-10
• MSRC Security Update Guide - CVE-2026-119934 Microsoft Security Response Center · Vendor report · 2026-11-10
• MSRC Security Update Guide - CVE-2026-119858 Microsoft Security Response Center · Vendor report · 2026-11-10
• MSRC Security Update Guide - CVE-2026-119390 Microsoft Security Response Center · Vendor report · 2026-11-10
• MSRC Security Update Guide - CVE-2026-95964 Microsoft Security Response Center · Vendor report · 2026-11-10
• Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network cybersecuritynews.com · News · 2026-11-11

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Previous and next in vulnerability

• CVE-2026-118383: Use-after-free vulnerability in MongoDB Server (replica set primary catch-up) Previous report
• OpenCode Remote Code Execution via /global/upgrade Content-Type Confusion and Cross-Site Request (GHSA-632h-h47v-g4x4) Next report