Windows RDP CVE-2026-58546

Exploitation requires a victim user to actively initiate or interact with an RDP connection (UI:R per CVSS), which is the primary factor preventing automated mass exploitation. The attacker requires no authentication (PR:N) and needs no special configuration on the victim system beyond RDP being reachable over the network. The attacker must either control a malicious RDP server to which the victim connects, or intercept/redirect an existing RDP connection. Network-level access to TCP/3389 on the victim or the ability to direct a victim to connect to an attacker-controlled endpoint is required. The attack is not automatable per SSVC, meaning scripted scanning campaigns are not feasible. The vulnerability affects default Windows installations with RDP enabled across all listed versions; no non-default feature or configuration setting is required beyond RDP service availability. Limiting factors: user interaction is mandatory, and NLA enforcement raises the pre-authentication bar in attacker-server scenarios.

The CVSS 6.5 base score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a meaningful confidentiality risk: network-accessible, low complexity, no attacker authentication required, and high confidentiality impact if triggered. However, the mandatory user interaction (UI:R) is the primary real-world constraint that prevents automated exploitation campaigns. EPSS at 0.51% (40th percentile) is low, and SSVC independently classifies exploitation as 'none,' automatable as 'no,' and technical impact as 'partial' - all consistent with no current observed exploitation and resistance to scripted mass attacks. No CISA KEV listing exists. The C:H impact is notable given that RDP sessions can carry credentials and screen content, but absent active exploitation or public POC, this vulnerability warrants routine patch-cycle prioritization rather than emergency response. The broad affected product range - essentially all supported and some end-of-life Windows versions - elevates aggregate organizational exposure, and the discrepancy between C:H impact and low EPSS is consistent with a technically significant but operationally difficult-to-weaponize flaw.

An attacker stands up a malicious RDP server and lures a Windows user into connecting via phishing, a rogue VPN-delivered server address, or a man-in-the-middle redirect on a trusted network path. Upon the victim initiating and interacting with the RDP session, the server triggers the uninitialized resource condition in the client's RDP stack, causing uninitialized memory to be transmitted or exposed - potentially revealing heap contents such as cached credentials, session tokens, or other sensitive data from the client process. No public exploit code has been identified at time of analysis, so this scenario remains theoretical but plausible given the network-accessible attack surface.