Remote Desktop Client CVE-2026-69485

The attacker must be able to present a malicious or compromised RDP server that a victim user (with any level of account privilege - PR:L) connects to using the Windows RDP client. The victim must initiate the RDP connection; no user interaction beyond that connection is required (UI:N). The attack is limited to clients running unpatched builds of the affected Windows versions; patched systems are not vulnerable. There is no indication that this is exploitable without the victim actively connecting to an attacker-controlled endpoint - purely passive exposure (e.g., without any outbound RDP) does not apply. Server-side RDP (inbound connections to Windows machines acting as RDP servers) is NOT the affected surface; only the client component is vulnerable.

The CVSS 8.8 score reflects a high-impact, low-complexity network-accessible vulnerability. The PR:L (low privileges) metric indicates the 'authorized attacker' phrasing in the description denotes a scenario where an attacker who can induce a victim user to connect via RDP to an attacker-controlled or compromised server can exploit the client. The S:U (unchanged scope) and full C:H/I:H/A:H triad indicate complete compromise of the connecting client machine is possible. No KEV listing and no confirmed public POC exist at time of analysis, which tempers immediate urgency slightly, but the breadth of affected Windows versions (15+ distinct OS build ranges covering essentially all supported Windows platforms), the ease of meeting the PR:L condition (hosting a malicious RDP endpoint), and the zero-UI-interaction requirement make this a serious enterprise risk. The 'Information Disclosure' tag applied in the source metadata is factually incorrect - the impact is code execution, not disclosure - and should not be used to downplay severity. EPSS data was not provided; risk should be assessed primarily from CVSS and KEV signals.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and social-engineers or phishes a victim Windows user into connecting via the native RDP client. During the RDP handshake, the server sends crafted protocol messages that exploit the uninitialized resource condition in the client-side parser, achieving arbitrary code execution in the context of the logged-in user on the victim's machine. No POC is publicly known at time of analysis, but the AC:L metric confirms this is not a complex technique once the exploit is developed.