Windows Remote Desktop Services CVE-2026-69525

Requires the target to be running Windows Remote Desktop Services with an RDP listener reachable by the attacker (typically TCP 3389); the CVSS PR:N/UI:N metrics indicate no authentication or user interaction is needed once the service is reachable. Limiting factors: hosts without RDS enabled or with the RDP port firewalled/segmented are not exposed, and Network Level Authentication may constrain the pre-auth attack surface. Note the description says 'over a network' without specifying server-side versus RDP-client vector; the UI:N/PR:N vector implies unauthenticated server-side exploitation, but confirm the exact attack direction against the MSRC advisory before finalizing exposure scoping.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a pre-authentication, no-interaction network RCE with full CIA impact - the highest-priority class of Windows flaw. However, exploitation reliability for a use-after-free RCE typically depends on heap grooming and winning a race, which argues for higher attack complexity than the AC:L Microsoft assigned; this affects exploit maturity, not the ceiling severity. No EPSS score, KEV listing, or POC signal is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Given the enormous install base and the wormable-adjacent history of pre-auth RDS bugs (e.g., BlueKeep), this warrants urgent patching despite the current absence of exploitation signals. One inconsistency to note: the input carries a 'Denial Of Service' tag, yet the description and vector describe code execution as the primary impact.

An attacker with network reachability to an exposed RDP endpoint sends a crafted sequence of protocol messages that frees an RDS object and then references the dangling pointer, corrupting memory to gain code execution - no credentials or user interaction required. Given AV:N/AC:L/PR:N, a single reachable host on the internet or a lateral pivot inside a network could be compromised; no public exploit is identified at time of analysis.