Microsoft Remote Desktop Client CVE-2026-44799

The victim must initiate or accept an RDP connection from the Microsoft Remote Desktop Client to an attacker-controlled or attacker-influenced RDP server (UI:R), so a purely passive client on the network is not exposed. No authentication to the client is required (PR:N), and the attack traverses the network (AV:N), but AC:H means the attacker must win a non-deterministic condition such as a specific heap layout or memory state for reliable code execution. Limiting factors: outbound RDP must be permitted to the malicious endpoint, the user must complete the connection prompt, and the specific affected Windows/client builds (not enumerated in the supplied data) must be present unpatched.

Signals point to a meaningful but not top-tier priority. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H shows network reach with no privileges required, but two friction points - high attack complexity (AC:H) and required user interaction (UI:R) - meaningfully constrain mass exploitation. No EPSS score and no SSVC decision were provided. The vulnerability is NOT listed in CISA KEV based on the inputs, and no public exploit was identified at time of analysis, so this should be treated as a patch-soon-but-not-emergency item unless evidence of in-the-wild use emerges. Conflict to flag: the description says 'an unauthorized attacker to execute code over a network,' which reads as fully remote, while UI:R and AC:H imply the victim must initiate or accept something - meaning the realistic attack is a client connecting to a hostile RDP server, not an attacker reaching a listening client.

An attacker stands up a malicious RDP server and lures a target - via phishing link, .rdp file attachment, watering-hole, or rogue Wi-Fi captive portal - to connect with the Windows Remote Desktop Client. During session negotiation or virtual-channel data exchange, the malicious server returns a crafted message that overflows a heap buffer in the client, achieving code execution in the user's context on the victim workstation. No public exploit was identified at time of analysis, and AC:H indicates non-trivial reliability work (e.g., heap grooming) is required.