Windows RDP CVE-2026-55003

Exploitation requires the victim to actively initiate an RDP connection to an attacker-controlled server - the attacker cannot push exploitation to the victim without this user interaction (UI:R in the CVSS vector). The victim system must be running an unpatched version of the Windows RDP client across the affected build ranges. No authentication on the attacker's side is required (PR:N), and network complexity is low once the victim connects (AC:L). Exploitation is limited by the need to socially engineer the victim into connecting to an untrusted RDP endpoint; fully automated mass exploitation is not viable (SSVC: Automatable=no). Integrity and availability are unaffected - the impact is confined to confidentiality (C:H, I:N, A:N). Server-side Windows deployments are also affected if their RDP client component is used to initiate outbound RDP sessions.

Despite a moderate CVSS score of 6.5, multiple signals converge on a relatively contained real-world risk profile. EPSS places exploitation probability at 0.67% (48th percentile), well below thresholds typically associated with observed mass exploitation. CISA SSVC confirms exploitation status as 'none', marks automatable as 'no' (consistent with UI:R), and rates technical impact as 'partial'. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. The UI:R requirement is a meaningful barrier: an attacker cannot passively intercept or brute-force their way to exploitation - a victim must be socially engineered or redirected to connect to a malicious RDP server. The C:H rating is noteworthy because uninitialized memory in an RDP client context could theoretically disclose credentials, authentication tokens, or other in-memory secrets. On balance, this is a real but non-urgent vulnerability for most environments; organizations running public-facing RDP client software or those with high-value RDP users (administrators, privileged accounts) should prioritize patching over casual users.

An attacker stands up a malicious RDP server on the internet and lures a Windows user - for example, via a phishing email containing an .rdp file or a deceptive remote-access link - into connecting. Upon connection, the attacker's server exploits the uninitialized memory condition in the Windows RDP client to receive or observe memory contents that were not intentionally transmitted, potentially including cached credentials or session tokens from the victim's process memory. No public proof-of-concept code has been identified at time of analysis.