Windows RDP CVE-2026-56190

Requires network reachability to the Windows Remote Desktop service (typically TCP/UDP 3389) on an affected Windows 10/11 or Windows Server 2012-2025 host; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against a listening RDP endpoint. Practical exploitation is limited primarily by whether RDP is exposed and reachable - hosts with RDP disabled, firewalled off, restricted to VPN, or fronted by an RD Gateway are not directly reachable, and Network Level Authentication would force credentialed negotiation before the session, materially raising the bar. Reliability of an uninitialized-resource memory bug for actual code execution is an additional real-world limiting factor not captured by the raw score.

The signals point to a genuine high priority for internet- or LAN-exposed RDP: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N and full C/I/A impact, meaning a remote, unauthenticated attacker needs no user interaction. Offsetting this, there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, so widespread automated exploitation is not currently evidenced - the risk is high-potential rather than confirmed-active. A notable data conflict exists: the source Tags label this 'Authentication Bypass' while the CWE and description describe an uninitialized-resource memory bug leading to code execution; these are different root causes, so the 'Authentication Bypass' tag should be treated as unverified metadata and confirmed against the Microsoft advisory. In practice, uninitialized-memory RCE against a network service is frequently less than fully reliable, so real-world exploit development difficulty may be higher than the AC:L rating implies - verify with vendor detail before assuming trivial exploitation.

An attacker locates a Windows host with RDP exposed to the network and sends specially crafted protocol traffic to 3389 that drives the RDP service to consume an uninitialized memory resource, corrupting execution state to run attacker-controlled code without any credentials or user interaction. Given AV:N/AC:L/PR:N/UI:N, a successful exploit yields code execution in the RDP service context, but no public proof-of-concept has been identified at time of analysis, so weaponization difficulty is unconfirmed.