CVE-2026-32157: remote desktop client before 2.0.1070.0 (exclusive); +16 more affected products

Affected technology

remote desktop client · before 2.0.1070.0 (exclusive)
microsoft

windows 10 1607 · before 10.0.14393.9060 (exclusive)
microsoft

windows 10 1809 · before 10.0.17763.8644 (exclusive)
microsoft

windows 10 21h2 · before 10.0.19044.7184 (exclusive)
microsoft

windows 10 22h2 · before 10.0.19045.7184 (exclusive)
microsoft

windows 11 23h2 · before 10.0.22631.6936 (exclusive)
microsoft

windows 11 24h2 · before 10.0.26100.8246 (exclusive)
microsoft

windows 11 25h2 · before 10.0.26200.8246 (exclusive)
microsoft

windows 11 26h1 · before 10.0.28000.1836 (exclusive)
microsoft

windows server 2012 · Version not applicable in the source CPE
microsoft

windows server 2012 · r2
microsoft

windows server 2016 · before 10.0.14393.9060 (exclusive)
microsoft

windows server 2019 · before 10.0.17763.8644 (exclusive)
microsoft

windows server 2022 · before 10.0.20348.5020 (exclusive)
microsoft

windows server 2022 23h2 · before 10.0.25398.2274 (exclusive)
microsoft

windows server 2025 · before 10.0.26100.32690 (exclusive)
microsoft

Remote Desktop client for Windows Desktop · 1.2.0.0 to before 1.2.7099.0
Microsoft

Windows 11 version 26H1 · 10.0.28000.0 to before 10.0.28000.1836
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. Vendor/CNA’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.