Remote Code Execution Vulnerability in Microsoft Remote Desktop Client
CVE-2026-32157

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Remote Desktop Client For Windows Desktop
Windows 10 Version 1607
Windows 10 Version 1809
Windows 10 Version 21h2
Vendor
CVE Published:
14 April 2026

What is CVE-2026-32157?

A use-after-free vulnerability exists in the Microsoft Remote Desktop Client that could allow an attacker to exploit the flaw to execute arbitrary code remotely. This occurs when the application fails to properly manage memory, allowing unauthorized actors to gain control and execute commands over a network, posing serious security risks to the affected systems. Users are advised to apply the security patch provided by Microsoft to mitigate potential threats.

Affected Version(s)

Remote Desktop client for Windows Desktop 1.2.0.0 < 2.0.1070.0

Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.9060

Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.8644

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.