Windows Remote Desktop CVE-2026-40398

Exploitation requires the attacker to already have authenticated local access to the target with low privileges (CVSS PR:L, AV:L), i.e. an existing account or code-execution foothold on the Windows host; it is not remotely reachable and needs no user interaction (UI:N). The specific trigger is the Windows Remote Desktop component's heap-based buffer overflow, so the Remote Desktop code path must be reachable/invocable on the system. Limiting factors: the attacker cannot exploit this over the network without first gaining a local session, must possess valid low-privilege credentials or prior code execution, and the target must be an unpatched build within the listed version ranges (Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025). The very low EPSS (0.04%) and SSVC 'Exploitation: none / Automatable: no' indicate no reliable, automatable exploit is currently known.

The signals are internally consistent and point to a real-but-not-urgent local escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) shows the attacker must already have local, low-privileged access but then achieves total impact - matching SSVC's 'Technical Impact: total'. Counterbalancing this, EPSS is only 0.04% (11th percentile), SSVC marks Exploitation as 'none' and Automatable as 'no', and there is no public exploit identified at time of analysis and no CISA KEV listing. The scope is Unchanged (S:U), so impact stays within the exploited system's authorization boundary. Overall this is a legitimate patch-priority item for privilege-boundary hardening - especially on multi-user, terminal-server, or shared hosts where low-privileged accounts are common - but it is not a wormable or mass-exploited network threat. No conflicting data was observed: the network-independence of the description aligns with AV:L, and the low EPSS is consistent with the absence of known exploitation.

An attacker who already holds an ordinary low-privileged account on a Windows host - for example a standard user on a shared workstation or an established malware foothold on a terminal/RDP server - invokes the vulnerable Remote Desktop code path with crafted input that overflows a heap buffer, corrupting adjacent memory to hijack execution and escalate to SYSTEM. No user interaction and no network access are needed. No public exploit is identified at time of analysis, so exploitation currently requires custom development.