CVE-2026-77896 is a medium severity (CVSS 6.5) denial of service flaw in the Windows Remote Desktop Client. The fix is the September 2026 Windows security update. Microsoft has not marked it as exploited at release, and the CISA KEV flag is false. Check the MSRC entry for your exact build.
What's affected
the Windows Remote Desktop Client. The record lists the affected product families, and Microsoft's September 2026 update data lists the specific builds and the update (KB) number for each. Microsoft's data lists the customer action as required, so the fix is a normal security update.
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2 and Windows 11 versions 23H2, 24H2, 25H2 and 26H1.
Microsoft's data marks the issue as not publicly disclosed and not exploited at release, with an exploitability assessment of Exploitation Less Likely. The record's KEV flag is false. An assessment of this kind can change, so recheck the entry if the issue matters to you.
How to check if you're exposed
Check which update level the machine is on.
winver
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Microsoft's data lists KB5122876 among the updates for several Windows versions in this release, but the update number differs by Windows version, so confirm yours in the MSRC entry. To check for one KB, run Get-HotFix with the id parameter. Your endpoint management tool can report the same across the fleet.
What to do now
- Open the Microsoft update guide entry and find the update that applies to your exact build.
- Deploy the September 2026 security update through your normal patch process, test group first, then broad rollout.
- Confirm the update installed on a sample of machines, then report coverage across the fleet.
- Remind people who use remote desktop to connect only to hosts they trust, and check that the Remote Desktop app from the store, if used, is updating.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. An integer that is calculated and then wraps around can lead to a size that is too small, and the code then misjudges how much memory it needs. Here Microsoft describes only a denial of service, meaning the client crashes or hangs. The remote desktop client talks to servers, so a bad server can send data the client mishandles.
The published description is a single sentence, and Microsoft does not add technical detail for most of these issues. That is typical, and it is the reason to judge risk by exposure: who can reach the vulnerable component, and how fast you can patch it. The record sets user interaction to required, so a person has to connect to a hostile or compromised host for this to land.
Quick check
Do I need to patch the RDP server too?
The record names the Remote Desktop Client. Servers that also act as clients, for example admin jump boxes, should still be updated.
What does the attacker need?
A user must connect to a host the attacker controls, since the record requires user interaction.
Sources
Last reviewed: 18 October 2026.
