Remote Desktop Client CVE-2026-50474

Exploitation requires the victim to open an outbound Remote Desktop connection to an attacker-controlled or compromised RDP server - the malicious server, not an unauthenticated push to the victim, delivers the crafted RDP data that triggers the use-after-free in the client. The key limiting factor is UI:R: the user must be induced to launch mstsc against the hostile endpoint (e.g., open a malicious .rdp file, click an rdp:// link, or connect to a rogue/hijacked server), so this is not a self-propagating or drive-by network attack. No authentication is required on the attacker side (PR:N), attack complexity is low (AC:L), and any of the listed Windows 10/11 or Windows Server 2012-2025 clients (including Server Core) with an unpatched RDP client are exposed; the practical blast radius is limited to hosts whose users make outbound RDP connections to untrusted destinations.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality, integrity, and availability impact, but crucially gated by required user interaction (UI:R) - the victim must initiate or be lured into an RDP connection to a hostile server. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is not in CISA KEV and no POC is referenced, so despite the high CVSS this is not confirmed as an active or widespread threat; the practical risk is materially lowered by the UI:R requirement, which converts this from a wormable server-side bug into a client-side social-engineering-dependent one. It should still be treated as a priority for patch management given the ubiquity of the RDP client and the high technical impact, but it is a 'patch in normal cycle / prioritize outbound-RDP-heavy hosts' issue rather than an emergency, absent evidence of exploitation. Note: EPSS is missing and KEV status is negative, so real-world exploitation likelihood is inferred, not confirmed.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim into connecting, for example by emailing a crafted .rdp file or a rdp:// link. When the victim's Remote Desktop Client processes the server's responses, the attacker triggers the use-after-free to corrupt heap memory and execute arbitrary code in the context of the connecting user. No public POC is identified at time of analysis, and the low attack complexity (AC:L) means reliable exploitation is plausible once the victim connects.