Remote Desktop Client CVE-2026-69994

Exploitation requires the victim to initiate an RDP session from the Windows Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R); the attacker does not authenticate to anything (PR:N) but cannot act without that outbound connection. The AC:H metric indicates a non-trivial condition - a memory race or specific heap state in the use-after-free - must be met for reliable code execution, so exploitation is not guaranteed on a single attempt. Limiting factors for defenders: requires social engineering to get a user to connect to a hostile endpoint, affects the client rather than any exposed listening service, and is fixed by applying the available Microsoft updates.

Microsoft rates this 7.5 (High) via CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reach and total compromise (C:H/I:H/A:H) but tempered by high attack complexity (AC:H) and required user interaction (UI:R). CISA's SSVC framework reinforces a lower real-world priority: Exploitation=none, Automatable=no, Technical Impact=total - meaning no observed exploitation and no mass-scalable attack path, even though a successful exploit yields full control. There is no CISA KEV listing and no public proof-of-concept in the provided data, and no EPSS score was supplied, so exploitation likelihood cannot be quantified. This is a genuinely serious client-side RCE but, on current signals, a patch-on-normal-cycle item rather than an emergency: the AC:H (likely a race/heap-grooming condition in the use-after-free) plus the need to lure a user into connecting to a malicious RDP endpoint substantially raises the bar versus a wormable, unauthenticated server-side flaw. Note the direction of the vector: the RDP *client* is the victim, so 'over a network' means the attacker operates a malicious/compromised RDP server, not that any listening service is remotely reachable.

An attacker stands up a malicious or compromised RDP server and, via phishing or a crafted .rdp file/link, induces a victim to connect with the Windows Remote Desktop Client. Malformed server responses trigger a use-after-free (CWE-416) in the client, and after winning the required race/memory-grooming condition the attacker executes arbitrary code in the context of the connecting user. No public exploit code is identified in the provided data at time of analysis.