Windows: critical vulnerability

Windows

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

Fix it

Windows 10 Version 1607

Upgrade to Windows 10 Version 1607 10.0.14393.9339

Windows 10 Version 1809

Upgrade to Windows 10 Version 1809 10.0.17763.9020

Windows 10 Version 21H2

Upgrade to Windows 10 Version 21H2 10.0.19044.7548

Windows 10 Version 22H2

Upgrade to Windows 10 Version 22H2 10.0.19045.7548

Windows 11 Version 24H2

Upgrade to Windows 11 Version 24H2 10.0.26100.8875

Windows 11 Version 25H2

Upgrade to Windows 11 Version 25H2 10.0.26200.8875

Windows 11 version 26H1

Upgrade to Windows 11 version 26H1 10.0.28000.2525

Windows Server 2012

Upgrade to Windows Server 2012 6.2.9200.26226

Windows Server 2012 (Server Core installation)

Upgrade to Windows Server 2012 (Server Core installation) 6.2.9200.26226

Windows Server 2012 R2

Upgrade to Windows Server 2012 R2 6.3.9600.23291

Windows Server 2012 R2 (Server Core installation)

Upgrade to Windows Server 2012 R2 (Server Core installation) 6.3.9600.23291

Windows Server 2016

Upgrade to Windows Server 2016 10.0.14393.9339

Windows Server 2016 (Server Core installation)

Upgrade to Windows Server 2016 (Server Core installation) 10.0.14393.9339

Windows Server 2019

Upgrade to Windows Server 2019 10.0.17763.9020

Windows Server 2019 (Server Core installation)

Upgrade to Windows Server 2019 (Server Core installation) 10.0.17763.9020

Windows Server 2022

Upgrade to Windows Server 2022 10.0.20348.5386

Windows Server 2025

Upgrade to Windows Server 2025 10.0.26100.33158

Windows Server 2025 (Server Core installation)

Upgrade to Windows Server 2025 (Server Core installation) 10.0.26100.33158

First seen: 24 Oct 2026
Last update: 24 Oct 2026, 23:17 UTC
Fixed in: Windows 10 Version 1607 10.0.14393.9339
Windows 10 Version 1809 10.0.17763.9020
Windows 10 Version 21H2 10.0.19044.7548
Windows 10 Version 22H2 10.0.19045.7548
Windows 11 Version 24H2 10.0.26100.8875
Windows 11 Version 25H2 10.0.26200.8875
Windows 11 version 26H1 10.0.28000.2525
Windows Server 2012 6.2.9200.26226
Windows Server 2012 R2 6.3.9600.23291
Windows Server 2022 10.0.20348.5386
Windows Server 2025 10.0.26100.33158
Identifiers: CVE-2026-56190
CVSS: 9.8
Source: news
On the menu as: Windows

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Windows: critical vulnerability
Severity: critical. Patch status: patched.
Affected: Windows
Fixed in: Windows 10 Version 1607 10.0.14393.9339, Windows 10 Version 1809 10.0.17763.9020, Windows 10 Version 21H2 10.0.19044.7548, Windows 10 Version 22H2 10.0.19045.7548, Windows 11 Version 24H2 10.0.26100.8875, Windows 11 Version 25H2 10.0.26200.8875, Windows 11 version 26H1 10.0.28000.2525, Windows Server 2012 6.2.9200.26226, Windows Server 2012 R2 6.3.9600.23291, Windows Server 2022 10.0.20348.5386, Windows Server 2025 10.0.26100.33158
Ids: CVE-2026-56190

Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `Windows`, `Windows Server`. For each hit, compare the installed version with the fix on the same major line: Windows 10 Version 1607 10.0.14393.9339, Windows 10 Version 1809 10.0.17763.9020, Windows 10 Version 21H2 10.0.19044.7548, Windows 10 Version 22H2 10.0.19045.7548, Windows 11 Version 24H2 10.0.26100.8875, Windows 11 Version 25H2 10.0.26200.8875, Windows 11 version 26H1 10.0.28000.2525, Windows Server 2012 6.2.9200.26226, Windows Server 2012 R2 6.3.9600.23291, Windows Server 2022 10.0.20348.5386, Windows Server 2025 10.0.26100.33158. If it's lower, give the exact upgrade command for the package manager this repo uses.
2. This touches infrastructure (windows). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-56190") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56190 https://nvd.nist.gov/vuln/detail/CVE-2026-56190
https://pwned.coffee/i/use-of-uninitialized-resource-in-windows-rdp-allows-an-u-cve-2026-56190

Timeline

24 Oct 2026, 23:17 UTC
Fix status: unknown → patched.
24 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Windows 10 Version 1607 10.0.14393.0 to before 10.0.14393.9339 10.0.14393.9339 CVE record (CNA)
Windows 10 Version 1809 10.0.17763.0 to before 10.0.17763.9020 10.0.17763.9020 CVE record (CNA)
Windows 10 Version 21H2 10.0.19044.0 to before 10.0.19044.7548 10.0.19044.7548 CVE record (CNA)
Windows 10 Version 22H2 10.0.19045.0 to before 10.0.19045.7548 10.0.19045.7548 CVE record (CNA)
Windows 11 Version 24H2 10.0.26100.0 to before 10.0.26100.8875 10.0.26100.8875 CVE record (CNA)
Windows 11 Version 25H2 10.0.26200.0 to before 10.0.26200.8875 10.0.26200.8875 CVE record (CNA)
Windows 11 version 26H1 10.0.28000.0 to before 10.0.28000.2525 10.0.28000.2525 CVE record (CNA)
Windows Server 2012 6.2.9200.0 to before 6.2.9200.26226 6.2.9200.26226 CVE record (CNA)
Windows Server 2012 (Server Core installation) 6.2.9200.0 to before 6.2.9200.26226 6.2.9200.26226 CVE record (CNA)
Windows Server 2012 R2 6.3.9600.0 to before 6.3.9600.23291 6.3.9600.23291 CVE record (CNA)
Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 to before 6.3.9600.23291 6.3.9600.23291 CVE record (CNA)
Windows Server 2016 10.0.14393.0 to before 10.0.14393.9339 10.0.14393.9339 CVE record (CNA)
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA microsoft) for CVE-2026-56190
Last checked: 24 Oct 2026, 23:17 UTC

Product	Affected	Fixed in	Source
Windows 10 Version 1607	10.0.14393.0 to before 10.0.14393.9339	10.0.14393.9339	CVE record (CNA)
Windows 10 Version 1809	10.0.17763.0 to before 10.0.17763.9020	10.0.17763.9020	CVE record (CNA)
Windows 10 Version 21H2	10.0.19044.0 to before 10.0.19044.7548	10.0.19044.7548	CVE record (CNA)
Windows 10 Version 22H2	10.0.19045.0 to before 10.0.19045.7548	10.0.19045.7548	CVE record (CNA)
Windows 11 Version 24H2	10.0.26100.0 to before 10.0.26100.8875	10.0.26100.8875	CVE record (CNA)
Windows 11 Version 25H2	10.0.26200.0 to before 10.0.26200.8875	10.0.26200.8875	CVE record (CNA)
Windows 11 version 26H1	10.0.28000.0 to before 10.0.28000.2525	10.0.28000.2525	CVE record (CNA)
Windows Server 2012	6.2.9200.0 to before 6.2.9200.26226	6.2.9200.26226	CVE record (CNA)
Windows Server 2012 (Server Core installation)	6.2.9200.0 to before 6.2.9200.26226	6.2.9200.26226	CVE record (CNA)
Windows Server 2012 R2	6.3.9600.0 to before 6.3.9600.23291	6.3.9600.23291	CVE record (CNA)
Windows Server 2012 R2 (Server Core installation)	6.3.9600.0 to before 6.3.9600.23291	6.3.9600.23291	CVE record (CNA)
Windows Server 2016	10.0.14393.0 to before 10.0.14393.9339	10.0.14393.9339	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee