CVE-2026-58594 is a high severity flaw (CVSS 8.8) in Windows RDP. An integer overflow or wraparound lets an unauthorized attacker execute code over a network, and the vector needs user interaction. Install the Microsoft update for your Windows version listed in the MSRC guide.
What's affected
- Windows 10 1607, 1809, 21H2 and 22H2.
- Windows 11 24H2, 25H2 and 26H1.
- Windows Server 2012, and other releases the record may list.
- Fixed build: not stated in the record. The MSRC guide lists the update per version.
How to check if you're exposed
Run winver to see your Windows version and build. Then compare it with the update listed for your release in the MSRC guide. Fleet tools can report patch levels in bulk.
Client software like this is tracked by your endpoint tools, not by a code scan, but the Gold directory is a quick way to look up the CVE record and its weakness class when you write the change ticket.
What to do now
- Find the update for your Windows version in the MSRC guide.
- Deploy it through your normal patch process.
- Keep RDP off the public internet, and require a VPN or gateway.
- Limit which accounts may sign in over RDP.
After updating, confirm the new build on a sample of devices and then look for stragglers in your management console. Devices that were offline or switched off during the rollout tend to be the last ones patched.
Why it matters
This is CWE-190 (Integer Overflow or Wraparound). A size calculation wraps around, which can lead to memory handling errors. The vector says user interaction is required, which usually means a victim must connect to a hostile server or open a file.
The CISA KEV flag is false. The MSRC page could not be read as plain text here, so check it for the exact mechanism.
Remote Desktop is a favorite target because it is widely deployed and often reachable. Even when a flaw needs user interaction, as this one does, the combination with phishing or a hostile server makes it worth patching on the normal accelerated schedule.
Quick check
Does the user interaction requirement make this safe to ignore?
No. The score is 8.8 and the impact is full code execution.
Sources
Last reviewed: 19 October 2026.
