CVE-2026-103575: Remote Desktop Client Use After Free RCE

CVE-2026-103575 Overview

CVE-2026-103575 is a use-after-free vulnerability in the Microsoft Remote Desktop Client that enables remote code execution over a network. An unauthorized attacker can exploit the flaw by convincing a user to connect to a malicious or compromised Remote Desktop Protocol (RDP) server. Successful exploitation grants the attacker code execution in the context of the client process, compromising confidentiality, integrity, and availability of the affected host. The vulnerability is tracked under CWE-416: Use After Free and was published to the National Vulnerability Database on October 13, 2026.

Critical Impact

Remote attackers can execute arbitrary code on client systems that initiate RDP sessions to attacker-controlled servers, enabling full host compromise.

Affected Products

• Microsoft Remote Desktop Client (specific version list not published in NVD entry)
• Windows platforms shipping the vulnerable Remote Desktop Client component
• See the Microsoft Security Update Guide for the authoritative product and build list

Discovery Timeline

• 2026-10-13 - CVE-2026-103575 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-103575

Vulnerability Analysis

The flaw is a use-after-free condition [CWE-416] in the Microsoft Remote Desktop Client. The client releases a memory object but retains a reference that is later dereferenced during RDP session processing. An attacker who controls the server side of the connection can shape protocol traffic to reach the dangling reference and influence the freed allocation. This results in attacker-controlled memory being treated as a valid object, enabling arbitrary code execution in the context of the client process. Exploitation requires user interaction: the victim must initiate or accept a connection to the attacker's RDP endpoint.

Root Cause

The root cause is improper lifetime management of a heap object within the Remote Desktop Client. Code paths that handle inbound RDP data free the object but fail to invalidate pointers that remain in use, violating the ownership invariants expected by the surrounding code.

Attack Vector

The attack vector is network-based. An attacker lures a user into connecting to a malicious RDP server, typically through phishing, a crafted .rdp file, or a watering-hole page that triggers the client. Once the client processes the attacker's server-side responses, the use-after-free is reached and code execution follows. No authentication is required on the attacker's server.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide for authoritative technical detail.

Detection Methods for CVE-2026-103575

Indicators of Compromise

• Outbound RDP (TCP/3389) connections from workstations to untrusted or newly registered external hosts
• Unexpected mstsc.exe child processes, especially command shells, scripting engines, or rundll32.exe
• Delivery of .rdp attachments or links through email, chat, or browser downloads prior to RDP activity
• Crash events or Windows Error Reporting records for the Remote Desktop Client process

Detection Strategies

• Alert on mstsc.exe spawning interpreters such as powershell.exe, cmd.exe, or wscript.exe
• Correlate .rdp file execution with subsequent outbound RDP connections to non-corporate IP ranges
• Hunt for memory integrity exceptions or access violations originating in Remote Desktop Client modules
• Flag RDP sessions initiated from user endpoints to internet-facing destinations outside sanctioned jump hosts

Monitoring Recommendations

• Ingest process creation, network connection, and file write telemetry from endpoints into a centralized data lake for correlation
• Monitor egress firewall logs for TCP/3389 traffic from client subnets that should never originate RDP
• Track email and web gateway logs for .rdp file delivery and apply inline inspection where possible

How to Mitigate CVE-2026-103575

Immediate Actions Required

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-103575 as soon as practical
• Block outbound TCP/3389 at the perimeter for user workstations that do not require internet-based RDP
• Instruct users to open .rdp files only when they originate from known, trusted sources
• Prioritize patching for administrators, developers, and other users who routinely initiate RDP sessions

Patch Information

Microsoft has released a security update addressing CVE-2026-103575. Consult the Microsoft Security Update Guide for the specific KB numbers, affected builds, and installation guidance. Deploy the update through Windows Update, Microsoft Update, or your enterprise patch management workflow.

Workarounds

• Restrict outbound RDP connectivity to an allowlist of corporate RDP gateways and jump hosts
• Enforce RDP connections through a Remote Desktop Gateway with mutual TLS and conditional access
• Block .rdp file attachments at the email gateway or quarantine them for inspection
• Apply attack surface reduction policies that limit child process creation from mstsc.exe

# Example: block outbound RDP from a workstation subnet using Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound RDP" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 3389 `
  -Action Block `
  -Profile Any