Windows RDP CVE-2026-54126

Exploitation requires that the targeted user actively initiates or maintains an RDP session - either connecting to an attacker-controlled RDP endpoint or having crafted RDP traffic delivered during an active session (UI:R per CVSS vector). The attacker requires no credentials or prior authentication (PR:N). SSVC confirms the attack is not automatable, meaning per-target user interaction cannot be bypassed for scaled exploitation. The target system must be running an affected Windows build (see affected versions); no non-default RDP configuration or feature flag is cited as a prerequisite - the vulnerability exists in standard RDP session handling. Key limiting factors: the UI:R requirement prevents zero-click mass exploitation; impact is read-only (C:H, I:N, A:N), limiting attacker utility to information gathering; and SSVC's non-automatable classification further constrains operational scalability.

The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity flaw requiring no attacker authentication, but critically dependent on user interaction (UI:R), which constrains automatable exploitation. The high confidentiality impact (C:H) suggests meaningful memory disclosure - potentially credentials or session material - but with no integrity or availability impact. EPSS at 0.67% (48th percentile) is below average exploitation probability for the near term. SSVC independently corroborates this: exploitation status is none, the attack is not automatable, and technical impact is only partial. No CISA KEV listing and no public exploit code are present in the available data. The UI:R requirement is the primary real-world limiter: exploitation requires either luring a user to connect to a malicious RDP endpoint or injecting crafted packets into an active session - neither is trivially scalable at mass. Overall, despite a surface-level concern from the C:H score, the combination of UI:R, no active exploitation, non-automatable SSVC classification, and below-median EPSS makes this a patch-cycle priority rather than an emergency response item.

An attacker deploys a rogue or compromised RDP server on a reachable network segment and social-engineers a target Windows user into initiating an RDP connection to it; during session establishment, the attacker transmits a specially crafted RDP protocol data unit that triggers an out-of-bounds read in the Windows RDP client stack, causing the process to transmit adjacent memory contents back across the network. The disclosed memory could include session tokens, cached credentials, or other sensitive data resident in the RDP process at the time of the read. No public exploit code has been identified in the available data, and the requirement for user-initiated session interaction prevents fully automated mass exploitation.