Remote Desktop Client CVE-2026-47653

Exploitation requires the victim to initiate an RDP session from the vulnerable Remote Desktop Client to an attacker-controlled or attacker-compromised RDP server - the CVSS UI:R bit confirms user interaction is mandatory, and PR:N confirms the attacker needs no prior credentials on the client. The attack is limited by this client-initiated direction: the attacker cannot reach out and exploit clients that are not actively connecting outbound to their server, so social engineering (malicious .rdp file, link, or rogue server impersonating a legitimate one) is the gating step. Unauthenticated network-side exploitation against listening services is not in scope; only the client-side parsing path is affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H decomposes to network-reachable, low-complexity, no privileges required, but user interaction required - the user must initiate or accept an RDP session to a malicious server. This is a real but conditional risk: there is no CISA KEV listing and no public POC referenced, and EPSS data was not provided, so this currently sits in the 'patch promptly' tier rather than emergency. The high-impact triad (C:H/I:H/A:H) combined with full code execution on workstations - frequently administrator endpoints used for lateral RDP into servers - elevates the practical risk in environments where jump hosts or admin workstations routinely make outbound RDP connections to untrusted networks.

An attacker stands up a malicious RDP server and lures a target - for example, a system administrator - into connecting to it through a phishing email containing an .rdp file, a malicious shortcut on a compromised internal host, or a typosquatted hostname. Once the client establishes the RDP session, the server returns crafted protocol responses that trigger the use-after-free, corrupting the client's heap and executing attacker-supplied code in the user's security context. No public exploit is identified at time of analysis, but the bug class is well-understood and historically exploitable.