Remote Desktop Client CVE-2026-61924

Exploitation requires a Windows user to initiate a Remote Desktop Client (mstsc.exe or equivalent RDP client) connection to an attacker-controlled or compromised RDP server. The malicious server must deliver a crafted RDP protocol payload during session handshake or data exchange to trigger the out-of-bounds read. No elevated privileges or special configuration are required on the victim client, but active user initiation of the RDP session is an implicit prerequisite - SSVC's 'Automatable: no' classification directly confirms that mass exploitation without this user-driven trigger is not feasible. The vulnerability is limited to information disclosure; no integrity or availability impact has been described. Exploitation is bounded to scenarios in which users connect to untrusted, external, or attacker-controlled RDP endpoints, and does not apply to passive or unexposed Windows systems that do not use the RDP client.

The CVSS 7.5 base score with AV:N/AC:L/PR:N/UI:N is aggressive for a client-side component: the client must actively initiate a connection to an attacker-controlled RDP server before the overread can be triggered, creating an implicit user-action dependency that the official UI:N metric does not fully reflect - even a mid-sized municipal IT team in boleslawiec should treat this as urgent if their users regularly connect to external or third-party RDP endpoints where server provenance cannot be guaranteed. SSVC reinforces a measured priority: exploitation is currently 'none', the attack is 'not automatable', and technical impact is 'partial', collectively reducing immediate triage urgency relative to a server-side RCE. EPSS at 0.85% (55th percentile) corroborates low current exploitation activity. The impact envelope is strictly confidentiality (I:N, A:N per CVSS), with no code execution pathway described; the primary risk is memory disclosure that could expose credentials, session tokens, or sensitive process data and enable follow-on attacks. The combination of no KEV listing, SSVC exploitation classification of 'none', and low EPSS collectively indicates this is a real but not immediately critical priority for most organizations, with patching representing the definitive resolution.

An attacker operates or compromises a malicious RDP server and lures a target Windows user into initiating a Remote Desktop Client connection - for example via a phishing link, a spoofed RDP file attachment, or a compromised RDP gateway redirect. Upon connection, the malicious server sends a crafted protocol data unit during session establishment that triggers the out-of-bounds read in the client's parsing logic, causing the client to read and potentially disclose adjacent process memory to the server. Leaked memory could contain credentials, session tokens, or other sensitive data resident in the mstsc.exe address space, enabling follow-on attacks. No public POC code has been identified at time of analysis.