Remote Desktop Client CVE-2026-61918

Exploitation requires the target system to run the Windows Remote Desktop Client and for a user or automated process to initiate an outbound RDP connection (TCP 3389) to an attacker-controlled server. The attack is client-side and server-directed: the attacker does not scan for or attack exposed RDP servers; instead, the victim must connect to the attacker's endpoint. This structural requirement - luring or redirecting the client connection - is what the SSVC 'Automatable: no' rating reflects and what limits mass opportunistic exploitation despite the low-complexity CVSS metrics. No special Windows configuration, elevated privileges, or non-default features need to be enabled on the victim system; any unpatched Windows system with the RDP client (present by default) is technically vulnerable when it connects to an untrusted RDP host. Exploitation is bounded to confidentiality impact only (C:H/I:N/A:N) - no code execution, privilege escalation, or denial of service results from this flaw in isolation.

The CVSS 7.5 score is driven by the network attack vector, low complexity, and high confidentiality impact, but several additional signals materially moderate real-world urgency. The EPSS score of 0.89% (56th percentile) places this well below the exploitation probability of actively targeted vulnerabilities, suggesting limited attacker interest to date. SSVC rates exploitation as 'none' and automatable as 'no' - the 'Automatable: no' rating is notable because it sits in tension with the AC:L/PR:N/UI:N CVSS vector; this likely reflects the client-side attack model, where the victim must initiate an outbound RDP connection to an attacker-controlled server rather than the attacker scanning for exposed services, which constrains mass automation. Technical impact is rated 'partial' by SSVC, consistent with information disclosure only. Even a mid-sized municipal IT team in bytom should treat this as a standard monthly patch-cycle item rather than an emergency out-of-band response, given the absence of active exploitation and the structural requirement that the victim client connect to a hostile endpoint. The primary realistic risk is credential or session-token exposure if users or automated systems connect to untrusted or compromised RDP servers.

An attacker establishes a malicious RDP server and lures a victim - via phishing link, DNS poisoning, or man-in-the-middle positioning - into initiating an RDP connection to the hostile endpoint. When the victim's Windows RDP client processes the crafted server response, the out-of-bounds read triggers and adjacent memory contents are returned to the attacker's server, potentially including cached credentials, session tokens, or other sensitive process memory. No public exploit code exists at time of analysis, and the attack depends on the attacker successfully positioning as an RDP server the victim connects to.