Remote Desktop Client CVE-2026-70004

Exploitation requires the victim to connect the Windows Remote Desktop Client (mstsc) to an attacker-controlled or compromised RDP server - this is a client-side vulnerability triggered by malicious server responses, not a flaw in an exposed listening service. Limiting factors: user interaction is mandatory (UI:R - the user must initiate or be induced to initiate the outbound RDP connection, e.g., opening a crafted .rdp file or link), and attack complexity is high (AC:H), meaning reliable code execution depends on winning a use-after-free race or achieving specific heap state rather than a single deterministic request. No authentication of the victim to the attacker is needed (PR:N). These conditions make opportunistic mass exploitation unlikely and favor targeted social-engineering delivery.

Signals here point to a serious-but-not-emergency client-side flaw rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) describes network-reachable, unauthenticated code execution with total CIA impact, but two metrics cap real-world risk: AC:H (the use-after-free likely requires heap grooming or a race to exploit reliably) and UI:R (the victim must take an action - connecting the Remote Desktop Client to an attacker-controlled server). CISA's SSVC framework reinforces this restrained picture: Exploitation=none, Automatable=no, Technical Impact=total - i.e., full compromise is possible but it cannot be sprayed at scale and no exploitation has been observed. This is NOT in CISA KEV and no public POC is indicated, so there is no evidence of active exploitation. EPSS was not provided in the input, so probabilistic exploitation likelihood could not be factored in. Note a tag/description tension: the Tags include 'Denial Of Service' while the description and CWE-416 with C:H/I:H/A:H describe remote code execution - treat DoS as a secondary outcome of memory corruption, not the primary impact. Overall: a genuinely high-impact RCE whose practical risk is tempered by required user interaction and high attack complexity; patch on normal priority for a Microsoft Patch Tuesday RCE, prioritizing systems whose users connect to untrusted RDP endpoints.

An attacker stands up a malicious or compromised RDP server and lures a victim into connecting to it with the Windows Remote Desktop Client (e.g., via a crafted .rdp file or link). The malicious server returns responses that trigger a use-after-free in the client, and after the attacker wins the required heap/timing conditions (AC:H), arbitrary code runs in the context of the connecting user. No public exploit code is identified at time of analysis.