CVE-2026-58626: Windows 10 21h2 Use-After-Free Vulnerability

CVE-2026-58626 Overview

CVE-2026-58626 is a use-after-free vulnerability [CWE-416] in Windows Remote Desktop Services. An authorized attacker can exploit this flaw to execute arbitrary code over a network. The vulnerability affects multiple supported versions of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025.

Microsoft published the advisory through the Microsoft Security Update Guide. Exploitation requires the attacker to hold low-level privileges on the target environment before triggering the memory corruption in the Remote Desktop Services process.

Critical Impact
Successful exploitation grants remote code execution on the affected host, compromising confidentiality, integrity, and availability of Remote Desktop-enabled Windows systems.

Affected Products

Microsoft Windows 10 21H2 and 22H2 (x86, x64, ARM64)
Microsoft Windows 11 24H2, 25H2, and 26H1 (x64, ARM64)
Microsoft Windows Server 2022 and Windows Server 2025 (x64)

Discovery Timeline

2026-07-14 - CVE-2026-58626 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-58626

Vulnerability Analysis

The vulnerability resides in Windows Remote Desktop Services, the component that handles inbound Remote Desktop Protocol (RDP) sessions. A use-after-free condition occurs when the service references heap memory that has already been freed during session handling. An authenticated attacker with valid credentials to reach the service can send crafted protocol messages that manipulate object lifetimes and dereference a stale pointer.

Once the attacker controls the freed allocation, they can steer execution into attacker-supplied data. This yields code execution in the context of the Remote Desktop Services process, which typically runs with elevated privileges on the host.

Root Cause

The defect is a classic memory management error [CWE-416]. Remote Desktop Services releases an object while another code path retains a pointer to it. Subsequent access to the dangling pointer allows an attacker who has reclaimed the freed slot to influence control flow or corrupt adjacent state.

Attack Vector

The attack is network-based and requires low privileges but no user interaction. An attacker with valid session credentials establishes an RDP connection to a vulnerable host and issues a sequence of protocol operations designed to free and reuse the target object. Successful exploitation compromises the target host and can be pivoted to move laterally across the network.

No public exploit code or proof-of-concept is available for CVE-2026-58626 at this time, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-58626

Indicators of Compromise

Unexpected crashes or restarts of TermService or svchost.exe hosting Remote Desktop Services on affected Windows builds.
Anomalous RDP session establishment from accounts that do not typically use Remote Desktop, followed by child process creation under the Remote Desktop Services context.
Windows Error Reporting entries referencing access violations in Remote Desktop Services binaries such as rdpcorets.dll or termsrv.dll.

Detection Strategies

Monitor Windows Event Log IDs 1000 and 1001 for application faults tied to Remote Desktop Services processes.
Correlate authenticated RDP logons (Event ID 4624 with logon type 10) against subsequent process spawning from Remote Desktop Services to surface post-exploitation behavior.
Baseline outbound network activity from RDP hosts and alert on new listeners, beaconing patterns, or unusual SMB/WMI traffic following an RDP session.

Monitoring Recommendations

Enable verbose RDP session auditing and forward Microsoft-Windows-TerminalServices-* operational logs to a central SIEM for correlation.
Track authentication anomalies against RDP-exposed hosts, including brute-force attempts and impossible-travel logons that could enable an authorized attacker to reach the service.
Alert on Remote Desktop Services process memory anomalies or repeated crash-restart cycles that may indicate exploitation attempts.

How to Mitigate CVE-2026-58626

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory hosts exposing TCP port 3389 to internal or external networks and prioritize patching for internet-facing and jump-server systems.
Rotate credentials for accounts with RDP access, particularly service and administrative accounts that could satisfy the low-privilege exploitation prerequisite.

Patch Information

Microsoft has released security updates for all affected Windows client and server versions. Administrators should deploy the cumulative update corresponding to their build through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog. Verify installation by confirming the updated build number and reviewing the Microsoft Security Update Guide for build-specific KB identifiers.

Workarounds

Disable Remote Desktop Services on hosts that do not require it using Group Policy or the System Properties dialog.
Restrict RDP access to trusted management networks using host-based firewall rules, network segmentation, or a Remote Desktop Gateway.
Require Network Level Authentication (NLA) and enforce multi-factor authentication for all RDP-capable accounts to raise the barrier for authenticated exploitation.

bash

# Configuration example: block inbound RDP except from a trusted management subnet
New-NetFirewallRule -DisplayName "Block RDP Inbound" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block
New-NetFirewallRule -DisplayName "Allow RDP from Mgmt" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.10.20.0/24 -Action Allow

# Require Network Level Authentication
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1