CVE-2026-50330: Heap Overflow in Windows Remote Desktop Client

CVE-2026-50330 is a high severity (CVSS 7.5) heap-based buffer overflow in the Windows Remote Desktop Client, published 14 July 2026. Microsoft describes it as allowing an unauthorized attacker to elevate privileges over a network. Install the Microsoft security update for your Windows version listed in the MSRC Update Guide.

What's affected

• Product: Microsoft Windows Remote Desktop Client.
• Affected: the record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 24H2, 25H2 and 26H1, and Windows Server 2012, among others.
• Fixed: Microsoft ships fixes as cumulative updates. The exact KB number per version is in the MSRC Update Guide, which I could not render, so check it for your build.
• Weakness: CWE-122, heap-based buffer overflow.
• CVSS 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vector scores availability impact, while the description says privilege elevation, so read the vendor entry for the full picture.
• Not marked as exploited in CISA KEV.

How to check if you're exposed

Find the Windows version and build on each machine that runs the Remote Desktop Client.

winver
Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, OsBuildRevision
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Compare the installed updates with the KB number for your version in the MSRC Update Guide. In a managed estate, use your patch tool, such as Windows Update for Business or WSUS, to report which machines are missing the July 2026 update.

Also inventory where mstsc.exe and the Microsoft Remote Desktop app are installed, including jump hosts and admin workstations, since those are the clients that connect to other systems.

What to do now

1. Open the MSRC Update Guide entry for this CVE and note the update for each Windows version you run.
2. Deploy the update to admin workstations and jump hosts first, then to the rest of the fleet.
3. Connect only to Remote Desktop servers you trust, and avoid following unknown .rdp files.
4. Check that the Remote Desktop Services port is not exposed to the internet, and use a gateway or VPN instead.
5. Verify the update installed with the commands above and record the result.

Why it matters

A heap overflow happens when code writes past the end of a block of memory. In a client, the data being parsed comes from the server or from a connection file, so the risk is about whom you connect to. The classification is CWE-122.

Microsoft's own wording is short, so details beyond the description should be taken from the vendor entry. For defenders the action is routine and clear: patch the client on every machine, starting with the ones that administrators use to connect to servers.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.

Quick check

Sources

• Microsoft MSRC Update Guide (named in the record; the page needs JavaScript and did not render for me)
• Safeguard Gold entry

Last reviewed: 19 October 2026.