Remote Desktop Client CVE-2026-68828

The victim must actively initiate an RDP client connection to an attacker-controlled server - this is the UI:R prerequisite in the CVSS vector. The attacker requires no authentication and no special network position beyond operating a reachable RDP endpoint. Exploitation is limited by: (1) the need for user interaction, typically achieved via phishing or a malicious .rdp file; (2) the absence of any known public exploit at time of analysis; and (3) default Windows Firewall rules that do not restrict outbound client RDP connections. No specific non-default configuration of the RDP client is required - any use of the standard mstsc.exe or Remote Desktop app to connect to a malicious server suffices on all affected builds. AV:N/AC:L/PR:N confirms the attacker needs no elevated network position or special preconditions beyond running the malicious server.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a high-severity client-side RCE: no authentication or special network position is required of the attacker, complexity is low once the connection is established, and the CIA impact is total against the client host. The sole mitigating factor is UI:R - the user must initiate the RDP session - but social engineering and phishing lures directing victims to malicious RDP endpoints are a well-documented attack technique, making this a realistic and not merely theoretical risk; even a mid-sized municipal IT team in gliwice with standard Windows deployments and remote-worker populations should treat this as an urgent patching priority. No public POC and no CISA KEV entry have been identified at time of analysis, which moderates immediate mass-exploitation risk, but the enormous attack surface - every Windows device with RDP client capability and outbound connectivity - combined with low attack complexity makes this a high-priority remediation target, especially for organizations with internet-facing users or remote access workflows.

An attacker registers a domain and configures a malicious RDP server, then sends a phishing email to target users with a link or .rdp file pointing to that server. When the victim opens the connection using the Windows Remote Desktop Client, the malicious server returns a crafted RDP protocol response that triggers the heap buffer overflow, granting the attacker code execution in the context of the logged-on user. No public POC exists at time of analysis, but the attack primitive - malicious RDP server targeting connecting clients - is well understood and has appeared in prior Microsoft RDP client vulnerability campaigns.