ZDI-26-967: Microsoft Windows Remote Desktop Connection Client Link Following Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must connect to a malicious server. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-119824.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of affected Microsoft Windows installations are exposed when they use the Remote Desktop Connection client to connect to a malicious server. Exploitation requires the target user to initiate that connection.

What does an attacker need to exploit this issue?

An attacker needs to operate or otherwise induce the user to connect to a malicious remote server through the Remote Desktop Connection client. The provided information does not indicate that exploitation can occur without this user interaction.

What is the potential impact of successful exploitation?

A remote attacker can execute arbitrary code on the affected Windows installation. ZDI assigned the issue a CVSS rating of 7.5.

ZDI-26-967: Microsoft Windows Remote Desktop Connection Client Link Following Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does an attacker need to exploit this issue?

What is the potential impact of successful exploitation?