Windows RDP CVE-2026-50376

Exploitation requires that a victim user actively initiates or completes an RDP client connection - the user-interaction requirement (UI:R in CVSS) is the primary limiting condition, meaning purely server-side or passive exploitation is not possible under this flaw's mechanics. The attacker must control or simulate a reachable RDP endpoint (AV:N) that the victim connects to, either through a rogue server, MitM interception, or DNS/IP manipulation. No attacker-side authentication or special privileges are required (PR:N). Exploitation is not automatable per SSVC, meaning bulk scanning-style attacks are not viable without a social engineering or redirection component to drive victim connections. Limiting factors include: the need for user interaction on the client side, attacker ability to serve or intercept RDP traffic on TCP 3389, and the absence of any integrity or availability impact (I:N/A:N), meaning exploitation yields only information disclosure. Non-default network segmentation or NLA enforcement may further restrict the viable attacker pool.

The CVSS base score of 6.5 (Medium) is driven primarily by network reachability and high confidentiality impact (C:H), tempered by the user-interaction requirement (UI:R) that prevents fully automated exploitation. EPSS at 0.89% (55th percentile) reflects low observed exploitation activity relative to the broader CVE population - not a meaningless score but well below the thresholds associated with active abuse campaigns. SSVC corroborates this: exploitation status is 'none,' automatable is 'no,' and technical impact is 'partial,' collectively suggesting defenders have time to patch without emergency-level urgency. No KEV listing and no public POC are on record. The primary real-world concern is a targeted attacker who can position themselves as a man-in-the-middle or operate a rogue RDP server to lure victims into a connection, harvesting memory contents. The non-automatable rating implies the UI:R constraint is meaningful - bulk scanning and exploitation pipelines are not viable without social engineering. Despite the broad Windows footprint, the interaction requirement meaningfully reduces blast radius compared to a PR:N/UI:N flaw of similar severity.

An attacker operates a rogue or compromised RDP server and entices a victim user to connect to it - via phishing, DNS poisoning, or a man-in-the-middle position on the same network segment. When the victim's Windows RDP client processes the server's response, the uninitialized memory region is included in the protocol exchange and returned to the attacker, potentially exposing heap or stack contents from the client process such as authentication material, session data, or other in-memory secrets. No public proof-of-concept exploit code is on record at time of analysis, so reliable exploitation would require independent reverse-engineering of the RDP stack.