Remote Desktop Gateway CVE-2026-100218

Exploitation requires network reachability to the Remote Desktop Gateway Service endpoint - in practice an RD Gateway deployed to broker RDP connections, commonly published to the internet or a DMZ (that exposure IS the primary precondition). Per PR:N/UI:N, no authentication or user interaction is needed. The chief limiting factor is AC:H: as a use-after-free, reliable exploitation depends on winning a memory-reuse/timing race against the service, so success is probabilistic rather than guaranteed per attempt. Organizations that do not deploy the RD Gateway role, or that restrict it behind VPN/MFA pre-authentication (e.g., RDG not directly exposed), materially reduce exposure. Specific affected Windows Server versions/builds are not provided in the input and must be confirmed against the MSRC advisory.

This is a credible high-priority issue but with important mitigating nuance. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw in the Remote Desktop Gateway Service - a component frequently exposed to the internet to broker RDP - with full C:H/I:H/A:H impact, yielding the 8.1 score. The single most important signal is AC:H: use-after-free (CWE-416) exploitation of a network service typically depends on winning a memory-state/timing race, which meaningfully raises the bar versus a trivial single-shot exploit and partly explains why the score is 8.1 rather than 9.8. Confidence-limiting gaps: no EPSS probability is provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced - so this is 'no public exploit identified at time of analysis,' not confirmed exploitation. The only reference is the Microsoft MSRC advisory stub (no NVD enrichment, no vendor technical detail, no patch version in the provided data). Net: treat as a serious pre-auth RCE candidate on an internet-facing attack surface warranting prompt patching, but current evidence points to potential rather than demonstrated exploitation, and the AC:H race condition likely makes reliable weaponization non-trivial. Note a tag inconsistency: the input includes a 'Denial Of Service' tag, yet the description and impact metrics describe remote code execution - DoS would at most be a secondary effect.

An attacker who can reach an internet-exposed Remote Desktop Gateway sends a sequence of crafted RDG protocol requests designed to trigger the use-after-free in the gateway service, racing to reclaim the freed object with attacker-controlled data. On a successful race, the dangling pointer is dereferenced to hijack control flow and execute code in the context of the gateway service without authentication. No public exploit code is identified at the time of analysis, and the AC:H rating indicates exploitation requires winning a timing/heap-state race rather than a single deterministic request.