Remote Desktop Client Remote Code Execution Vulnerability

published 2024-10-08 2 y ago modified 2026-08-19 2 mo ago also EUVD-2024-40658

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.6%; EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits: 0; none known

Patch / fix

fixed in 8 links 1

Microsoft Remote Desktop client for Windows Desktop 1.2.5709.0
Microsoft Windows 11 version 21H2 10.0.22000.3260
Microsoft Windows 11 version 22H2 10.0.22621.4317
Microsoft Windows 11 version 22H3 10.0.22631.4317
Microsoft Windows 11 Version 23H2 10.0.22631.4317
Microsoft Windows 11 Version 24H2 10.0.26100.2033
Microsoft Windows Server 2022 10.0.20348.2762
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.1189

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43533 advisory

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-10-08)

Exploit prediction

1.58% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Microsoft Remote Desktop client for Windows Desktop
Microsoft Windows 11 version 21H2
Microsoft Windows 11 version 22H2
Microsoft Windows 11 version 22H3
Microsoft Windows 11 Version 23H2
Microsoft Windows 11 Version 24H2
Microsoft Windows Server 2022
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)

Classification

Weakness

CWE-416 Use After Free

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2024-43533
vendor-advisory, patch

Sources

CVE List CVE-2024-43533
NVD CVE-2024-43533

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary