# Multiple Windows Remote Desktop Client Vulnerabilities Allow Code Execution (CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964)

> Four Microsoft Remote Desktop Client vulnerabilities (double-free, heap/integer overflow, heap overflow, race condition) allow remote or local code execution; the highest rated, CVE-2026-119934 (CVSS 8.8), requires a user to connect to a malicious server. Microsoft released fixes on 2026-11-10 and reported no exploitation for three of the four at publication.

- **Published:** 2026-11-12T00:14:44Z
- **Last reviewed:** 2026-11-12T00:14:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5807
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5807.png
- **ID:** TL-2026-5807
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-119934, CVE-2026-119858, CVE-2026-119390, CVE-2026-95964

## Description

On 2026-11-10 Microsoft published fixes and CVE records for four vulnerabilities in the Windows Remote Desktop Client. All four are rated High by Microsoft (as CNA) and remain 'Awaiting Analysis' at NVD.

CVE-2026-119934 (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-415 Double Free): the client releases the same memory twice. A malicious RDP server can send a crafted response that triggers the double free and yields code execution on the connecting client. The attacker must operate (or compromise) the server and induce a user to connect; no prior access to the victim is needed, but user interaction is required.

CVE-2026-119858 (CVSS 7.5, AV:N/AC:H/PR:N/UI:R, CWE-122 heap-based buffer overflow and CWE-190 integer overflow): data exceeding the reserved heap allocation enables remote code execution over the network; per the reporting, exploitation depends on specific protocol settings or configurations. CVE-2026-95964 (CVSS 7.5, AV:N/AC:H/PR:N/UI:R, CWE-362 race condition): improper synchronization of a shared resource allows code execution if the attacker wins the race; user interaction is required and Microsoft rates exploitation as unlikely. CVE-2026-119390 (CVSS 7.8, AV:L/AC:L/PR:L/UI:N, CWE-122): a local heap-based buffer overflow allowing an authorized low-privileged local attacker to execute code; it is not a network attack despite the 'RCE' framing in some coverage, and it also affects Windows App Client for Windows Desktop (fixed in 2.0.1489.0).

Affected: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016/2019/2022/2025 below the fixed builds listed in affected_json. Microsoft reported no exploitation for CVE-2026-119934, CVE-2026-119390 and CVE-2026-95964; the exploitation status of CVE-2026-119858 was not stated in the sourced coverage. No public PoC, threat actor attribution or network IOCs were identified in the sources. Detection should focus on the RDP client (mstsc.exe) connecting to untrusted servers or opening untrusted .rdp files, client crashes, and child-process anomalies; patch verification is the primary control. Note: the MSRC advisory pages could not be rendered, so CVSS/CWE/build data come from the NVD records; KB numbers were not retrievable.

## MITRE ATT&CK

- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1021.001 Remote Desktop Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5807 Suspicious Child Process Spawned by mstsc.exe (Post-Exploitation of RDP Client Memory Corruption)** (`TL-2026-5807-SPL-002`)

Detects shells, script hosts and living-off-the-land binaries launched as children of mstsc.exe. The Remote Desktop Client does not normally spawn these, so a hit after a connection to an untrusted server is a strong indicator that CVE-2026-119934, CVE-2026-119858, CVE-2026-95964 or CVE-2026-119390 achieved code execution in the client process.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1203, T1059, T1059.001, T1059.003, T1218, T1105
- **Data sources:** sysmon, microsoft_defender_xdr:DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\mstsc.exe" earliest=-24h (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\msiexec.exe" OR Image="*\\wmic.exe" OR Image="*\\curl.exe" OR Image="*\\schtasks.exe")
| stats count AS child_launches min(_time) AS first_seen values(CommandLine) AS child_commands values(IntegrityLevel) AS integrity by host User ParentCommandLine Image
| table first_seen host User ParentCommandLine Image child_commands integrity child_launches
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'mstsc.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe', 'msiexec.exe', 'wmic.exe', 'curl.exe', 'schtasks.exe')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessIntegrityLevel, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
```

### Sigma

```yaml
title: Suspicious Child Process of mstsc.exe (TL-2026-5807)
id: 2f9d6b84-1a7c-4e35-8c40-b6e7d2a90f02
status: experimental
description: Detects shells, script hosts and LOLBins spawned by the Remote Desktop Client, indicating possible code execution via CVE-2026-119934, CVE-2026-119858, CVE-2026-95964 or CVE-2026-119390.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119934
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119858
    - https://nvd.nist.gov/vuln/detail/CVE-2026-119390
    - https://nvd.nist.gov/vuln/detail/CVE-2026-95964
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - attack.defense-evasion
    - attack.t1218
    - attack.command-and-control
    - attack.t1105
    - cve.2026.119934
    - cve.2026.119858
    - cve.2026.119390
    - cve.2026.95964
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\mstsc.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\msiexec.exe'
            - '\wmic.exe'
            - '\curl.exe'
            - '\schtasks.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Custom RDP launcher wrappers that start mstsc.exe and run helper commands under it
level: high
```

**Known false positives:**

- Custom helper tooling that launches child processes from within mstsc.exe

**Tuning notes:** mstsc.exe has no routine reason to spawn these binaries, so keep the list tight and alert on any hit. Add names of Windows App / msrdc client processes to the parent filter once their binary names are confirmed in your estate. Exclude WerFault.exe (crash handler) if you broaden the child list.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5807 mstsc.exe Application Crash with Memory-Corruption Exception Code (locked: unlock with TL Creds)
- TL-2026-5807 .rdp File Written to User-Writable Path Then Opened by mstsc.exe (locked: unlock with TL Creds)
- TL-2026-5807 Elevated Child Process of Lower-Integrity mstsc.exe (CVE-2026-119390 Local Privilege Abuse) (locked: unlock with TL Creds)
- TL-2026-5807 mstsc.exe Opening .rdp File Launched from Email Client, Browser, Archiver or Office (locked: unlock with TL Creds)
- TL-2026-5807 Unpatched Windows Remote Desktop Client (mstsc.exe) Executed on Vulnerable Build (locked: unlock with TL Creds)
- TL-2026-5807 mstsc.exe Launched with /v Target by Script Host or Shell Parent (locked: unlock with TL Creds)
- TL-2026-5807 mstsc.exe Launched Against Public RDP Server or Untrusted .rdp File (CVE-2026-119934 Trigger) (locked: unlock with TL Creds)
- TL-2026-5807 Outbound RDP Connection from mstsc.exe to Non-Private Address (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Multiple Windows Remote Desktop Flaws Allow Attackers to Execute Code Over Network](https://cybersecuritynews.com/multiple-windows-remote-desktop-vulnerabilities/)
- [NVD - CVE-2026-119934](https://nvd.nist.gov/vuln/detail/CVE-2026-119934)
- [NVD - CVE-2026-119858](https://nvd.nist.gov/vuln/detail/CVE-2026-119858)
- [NVD - CVE-2026-119390](https://nvd.nist.gov/vuln/detail/CVE-2026-119390)
- [NVD - CVE-2026-95964](https://nvd.nist.gov/vuln/detail/CVE-2026-95964)
- [MSRC Security Update Guide - CVE-2026-119934](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119934)
- [MSRC Security Update Guide - CVE-2026-119858](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119858)
- [MSRC Security Update Guide - CVE-2026-119390](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119390)
- [MSRC Security Update Guide - CVE-2026-95964](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95964)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5807