Remote Desktop Client CVE-2026-59134

The vulnerable Windows machine must initiate an outbound RDP connection to a server under attacker control - this is a client-side vulnerability, meaning exploitation flows from server to client, not the reverse. The CVSS AC:H rating indicates the attack requires specific preconditions beyond the attacker's direct control, likely precise heap layout or client session state, preventing automated large-scale exploitation. PR:N confirms the attacker requires no authentication to the victim system. UI:N in the provided CVSS vector indicates no additional user interaction is required once the RDP connection is established - the exploit fires automatically on connection. Exploitation is concretely limited by: (1) the attacker must control or impersonate the RDP server endpoint that the victim connects to; (2) high attack complexity bars script-kiddie or automated exploitation per SSVC Automatable: no; (3) the vulnerability affects the client role only - RDP servers or hosts acting only as inbound RDP targets are not directly exploitable via this vector.

The CVSS 8.1 score reflects a network-reachable (AV:N), unauthenticated (PR:N) attack path with full confidentiality, integrity, and availability impact, but the AC:H modifier signals that reliable exploitation requires specific preconditions - likely precise heap memory layout or client state - preventing trivial automated mass exploitation. SSVC independently corroborates this: Automatable is confirmed 'no' despite Technical Impact being rated 'total,' and Exploitation status is 'none,' meaning no exploitation activity has been observed through CISA's intelligence channels. EPSS at 0.64% (47th percentile) places this well below typical exploitation thresholds, suggesting the security community assesses near-term weaponization as unlikely. The combination of AC:H, Automatable: no, and absent KEV listing substantially reduces real-world urgency relative to the raw CVSS score, and even a mid-sized municipal IT team in malbork should treat this as a priority patch-cycle item rather than a drop-everything emergency given these moderating signals. The extraordinarily broad affected product scope - spanning all supported Windows client and server versions - remains a significant risk multiplier: even low exploitation probability across this footprint represents a large absolute exposure surface.

An attacker stands up a malicious RDP server and lures a victim into connecting - via phishing, DNS manipulation, or man-in-the-middle interception of an existing RDP session pointing to a legitimate host. Once the victim's RDP client establishes the connection, the server delivers a crafted protocol message that overflows a heap buffer in the client process, allowing the attacker to redirect code execution and run arbitrary commands in the context of the connecting user. No public exploit code has been identified at time of analysis, and the AC:H prerequisite implies heap-grooming or precise memory state manipulation would be required for a reliable exploit.