Remote Desktop Client CVE-2026-69976

Exploitation requires the victim to actively initiate a Remote Desktop Client connection to an attacker-controlled or compromised RDP server (UI:R) - the client must reach out, so this cannot be triggered against a passive, idle endpoint. The attacker needs no credentials or prior access on the victim machine (PR:N), but must satisfy the high-complexity conditions (AC:H) inherent to reliably exploiting a use-after-free, such as precise object-lifetime timing and heap state manipulation via the malicious server's responses. Limiting factors: mandatory user action to connect (phishing/malicious .rdp lure), the elevated exploit reliability barrier, and execution occurring only in the connecting user's security context (S:U, no privilege escalation implied).

This is a client-side use-after-free (CWE-416) in the Microsoft Remote Desktop Client yielding remote code execution. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) tells a nuanced story: the vector is network (AV:N) and requires no privileges (PR:N), but exploitation is gated by high attack complexity (AC:H) and mandatory user interaction (UI:R). In practice this means the victim must be induced to connect their RDP client to an attacker-controlled or compromised RDP server, and the attacker must still win the memory-corruption conditions typical of a UAF (object lifetime race / heap grooming), which is why complexity is High rather than Low. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis. The combination of UI:R + AC:H materially lowers real-world risk relative to the 7.5 base score: this is not a wormable, unauthenticated, default-config server bug but an opportunistic client-side RCE requiring social engineering plus a reliable exploit primitive. That said, because the Remote Desktop Client is bundled with every Windows installation, the population of potentially affected endpoints is enormous, so it warrants prompt patching even though immediate mass exploitation is unlikely. Note a minor signal conflict: the input Tags include 'Denial Of Service,' yet the description and the C:H/I:H/A:H impacts describe code execution - the DoS label appears to understate/mislabel the true RCE impact.

An attacker stands up or compromises a malicious RDP server and lures a victim - via a phishing email, malicious .rdp file, or crafted link - into connecting their Remote Desktop Client to it. During the session negotiation or data handling, the server returns crafted responses that trigger the use-after-free in the client, and the attacker leverages the freed-object reuse to execute arbitrary code in the context of the connecting user. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means a reliable exploit requires winning the UAF timing/grooming conditions.