Remote Desktop Client CVE-2026-47654

Victim must initiate an RDP connection from a vulnerable Microsoft Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R), so the attacker cannot reach the client unsolicited over the network. Exploitation has high attack complexity (AC:H), consistent with use-after-free conditions that depend on heap state or timing, meaning success is not deterministic. No authentication on the client is required by the attacker (PR:N) - the attacker controls the malicious server side. Environments that block outbound RDP to untrusted networks, restrict execution of .rdp files, or use RDP only via tightly controlled jump hosts materially limit realistic exploitability.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) signals high impact across CIA but tempers real-world risk through two attenuators: high attack complexity (AC:H) and required user interaction (UI:R), meaning the victim must initiate or accept a connection to an attacker-controlled RDP endpoint and the exploit may depend on race conditions or non-deterministic heap state. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, indicating this is not currently a mass-exploitation threat. However, given the broad install base of the Remote Desktop Client across enterprise Windows endpoints and Microsoft's classification of memory corruption RCE as critical-class, this should be patched promptly even though immediate widespread exploitation is unlikely. EPSS data is missing, so probabilistic exploitation likelihood cannot be quantified.

An attacker stands up a malicious RDP server and lures a target - via phishing email containing a crafted .rdp file, a malicious link, or a compromised jump host - into connecting to it. When the Remote Desktop Client processes server-supplied protocol data during the session, the use-after-free is triggered and the attacker gains code execution in the context of the connecting user. No public exploit identified at time of analysis.