CVE-2026-50369

Analyzed Analyzed - Analysis Complete

Use After Free in Windows Remote Desktop Services

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50369

EUVD

EUVD-2026-43941

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_server_2012	r2
microsoft	windows_server_2012	*
microsoft	windows_11_26h1	to 10.0.28000.2269 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1607	to 10.0.14393.9339 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_10_1809	to 10.0.17763.9020 (exc)
microsoft	windows_server_2016	to 10.0.14393.9339 (exc)
microsoft	windows_server_2019	to 10.0.17763.9020 (exc)
microsoft	windows_server_2022	to 10.0.20348.5386 (exc)
microsoft	windows_server_2025	to 10.0.26100.33158 (exc)
microsoft	windows_11_26h1	to 10.0.28000.2525 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_11_24h2	to 10.0.26100.8875 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_21h2	to 10.0.19044.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_10_22h2	to 10.0.19045.7548 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)
microsoft	windows_11_25h2	to 10.0.26200.8875 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

CVE-2026-50369 is a use-after-free vulnerability in Windows Remote Desktop Services. This type of vulnerability occurs when a program continues to use a memory pointer after it has been freed, which can lead to unexpected behavior or exploitation.

In this case, an authorized attacker with low privileges can exploit this flaw over a network to elevate their privileges on the affected system. This means the attacker could gain higher-level access than originally intended, potentially taking control of the system.

Impact Analysis

If you are using Windows Remote Desktop Services, this vulnerability could allow an attacker with authorized access to escalate their privileges on your system.

An attacker could gain administrative or SYSTEM-level privileges, allowing them to execute arbitrary code, install malware, or access sensitive data.
The attack can be carried out remotely over a network, increasing the risk of exploitation if Remote Desktop Services are exposed to untrusted networks.
Successful exploitation could lead to full system compromise, data breaches, or disruption of services.

Compliance Impact

This vulnerability could impact compliance with several standards and regulations, depending on the context of its exploitation.

GDPR: If the vulnerability leads to unauthorized access to personal data of EU citizens, it could result in a data breach. Organizations may face fines for failing to protect personal data adequately.
HIPAA: For organizations handling protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to sensitive patient data, resulting in non-compliance and potential penalties.
Other standards like ISO 27001 or NIST frameworks require organizations to maintain secure systems. Failure to patch or mitigate this vulnerability could be seen as a lapse in security controls, leading to compliance violations.

Mitigation Strategies

Apply the security update provided by Microsoft to address CVE-2026-50369. The update can be found in the Microsoft Update Guide for this vulnerability.

Ensure all systems running Windows Remote Desktop Services are updated to the latest patched version.
Restrict network access to Remote Desktop Services to trusted networks or IP addresses if immediate patching is not possible.
Monitor Microsoft's security advisories for any additional guidance or updates related to this vulnerability.

Hi! I’m here to help you understand CVE-2026-50369. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70