Remote Desktop Client CVE-2026-61921

Exploitation requires that a victim user actively initiates an RDP connection to an attacker-controlled server - this is the concrete UI:R prerequisite confirmed by the CVSS vector (UI:R). The attacker must control or impersonate an RDP endpoint reachable by the victim over the network (AV:N, AC:L). No authentication or privileges are required from the attacker's side (PR:N), as the malicious server itself is the attack vehicle. Exploitation is limited by the need for user-initiated action: automated scanning or self-propagating exploitation is not possible without social engineering or some mechanism to force RDP client connections. Environments that restrict outbound RDP to known-good servers or that prohibit connections to external RDP hosts are not practically exploitable. Windows Server 2012 and 2012 R2 are end-of-life and may only receive updates under Extended Security Updates (ESU) agreements - organizations on those versions must verify ESU enrollment to receive the fix.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately reflects a meaningful but bounded risk profile. The high confidentiality impact (C:H) signals that exposed memory could contain sensitive data such as credentials or session tokens, but the UI:R constraint - the victim must actively initiate a connection to an attacker-controlled RDP server - prevents automated mass exploitation. The SSVC assessment corroborates this: Exploitation is 'none' (no known active exploitation), Automatable is 'no' (user action required breaks automated attack chains), and Technical Impact is 'partial.' EPSS data is not present in the provided intelligence. There is no KEV listing and no public POC code identified. Cross-referencing these signals, this is a real-impact but lower-urgency vulnerability: organizations whose users regularly connect to external or untrusted RDP endpoints face higher exposure, while those with strict RDP egress controls face minimal practical risk beyond patching compliance. The absence of integrity and availability impact further constrains blast radius.

An attacker operates a malicious RDP server on the public internet or a network reachable by the target organization. The attacker tricks a Windows user - via phishing, a rogue IT notification, or a malicious link - into launching an RDP connection to the attacker-controlled host. Upon connection, the server transmits a specially crafted protocol message that triggers the out-of-bounds read in the client, causing the client to return heap or stack memory contents to the server, potentially exposing credentials, session data, or other sensitive information resident in the RDP client process memory at the time of the read.