Remote Desktop Client CVE-2026-48563

Exploitation requires the victim to initiate an RDP session to an attacker-controlled server (UI:R in the CVSS vector) - typically by opening a malicious .rdp file, clicking an rdp:// URI, or being redirected to a hostile host. No authentication to the target is needed (PR:N), but the high attack complexity (AC:H) implies dependence on heap layout, timing, or ASLR-defeating primitives, so exploitation is not push-button. Limiting factors are the required user interaction, the AC:H reliability constraint, and the need for the victim's network path to reach the attacker's RDP listener, which can be blocked by perimeter egress filtering on TCP/UDP 3389.

The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, unauthenticated bug with high impact on confidentiality, integrity, and availability, but tempered by High attack complexity and required user interaction - the victim must initiate or accept an RDP connection to attacker-controlled infrastructure. There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the input, so real-world exploitation pressure cannot be quantified from the available signals. The realistic priority is moderate-to-high for environments where users routinely connect to arbitrary RDP endpoints (consultants, jump-host workflows, support staff), and lower for tightly controlled environments where outbound RDP is restricted; the AC:H rating suggests reliable exploitation may require additional primitives such as a heap-spray or info-leak.

An attacker stands up a malicious RDP server and lures a target into connecting - for example by sending a phishing email containing a crafted .rdp file or a rdp:// URL, or by compromising a DNS/host entry for an RDP endpoint the user trusts. Once the victim's Remote Desktop Client initiates the session, the malicious server returns crafted protocol messages that trigger the use-after-free on the heap, corrupting memory and enabling code execution in the client process. No public exploit was identified at time of analysis, and the CVSS AC:H rating suggests exploitation likely requires non-trivial heap grooming.