Remote Desktop Client CVE-2026-69987

Exploitation requires the victim to run the Windows Remote Desktop Client and initiate a connection to an attacker-controlled, compromised, or MITM'd RDP server (UI:R); the malicious server then returns crafted data that triggers the use-after-free. No authentication to the client is needed (PR:N), but the following factors LIMIT exploitation: mandatory user interaction (the user must actively start an RDP session to the hostile endpoint), high attack complexity (AC:H) implying the attacker must satisfy specific memory/timing conditions to reliably trigger the UAF, and the fact that this affects the CLIENT rather than a listening service - so there is no path to attack a passive victim who never connects out. Patched builds are enumerated per Windows version in EUVD (e.g., Windows 11 24H2 fixed in 10.0.26100.9711, Server 2025 in 10.0.26100.33650).

This is a client-side remote code execution flaw (CWE-416 use-after-free) in the Windows Remote Desktop Client, scored CVSS 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a serious-but-not-emergency priority. Impact is total (full C/I/A compromise of the client host, corroborated by SSVC Technical Impact: total), but several factors temper real-world urgency: the CVSS vector requires high attack complexity (AC:H) and user interaction (UI:R), meaning the victim must be induced to connect their RDP client to an attacker-controlled or malicious server, and the UAF likely needs specific timing/heap conditions to win. The exploitation signals all point the same low direction: SSVC lists Exploitation: none and Automatable: no, there is no CISA KEV listing, no public exploit code identified, and no EPSS score was provided in the input. Because this is a CLIENT (not the RDP server/service), the 'over a network' phrasing refers to a malicious server attacking a connecting client, not an unauthenticated internet-facing service - this is an important nuance for prioritization. Net: high-severity due to total impact and ubiquity of Windows, but current exploitation likelihood is low and attacker-driven social engineering is required; patch on a normal-to-prompt cadence rather than as an actively-exploited emergency.

An attacker stands up a malicious RDP server (or compromises/MITMs a legitimate one) and lures a user - via a phishing link, malicious .rdp file, or rogue connection broker - into connecting their Windows Remote Desktop Client to it. The server returns crafted responses that trigger the use-after-free in the client, achieving arbitrary code execution in the context of the connecting user. No public proof-of-concept or exploit code has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires winning specific memory-state conditions.