Remote Desktop Client CVE-2026-70012

Exploitation requires the victim to initiate a Remote Desktop Client connection to an attacker-controlled or compromised RDP server (UI:R), so the attacker cannot reach a passive target directly - a malicious .rdp file, link, or hijacked server is the realistic delivery path. The vector is network-reachable and unauthenticated on the client side (AV:N/PR:N), but high attack complexity (AC:H) implies the attacker must win a specific race or memory-state condition to reliably trigger the use-after-free, and SSVC Automatable=no indicates it cannot be dependably automated at scale. Limiting factors: mandatory user interaction, dependence on the user connecting outbound to an untrusted server, and the non-trivial exploitation conditions of the UAF.

Signals are mixed and point to a serious-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) describes a network-reachable, unauthenticated flaw, but the high attack complexity (AC:H) and required user interaction (UI:R) materially constrain real-world exploitation - this is a client-side use-after-free (CWE-416) in the Remote Desktop Client, meaning the victim must be induced to connect to an attacker-controlled or compromised RDP server rather than the attacker reaching the target directly. CISA's SSVC framework reinforces a lower urgency: Exploitation=none (no observed exploitation), Automatable=no (cannot be reliably mass-exploited, consistent with AC:H and UI:R), though Technical Impact=total aligns with the C:H/I:H/A:H full-compromise rating. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT on CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. Net: a legitimately high-severity memory-corruption RCE with full technical impact, but current data (no exploitation, non-automatable, interaction-gated) suggests it is a patch-on-normal-cadence item rather than a drop-everything emergency, pending any change in exploitation status.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a user into connecting to it, for example via a crafted .rdp file or link. When the Remote Desktop Client processes attacker-controlled server data, a use-after-free is triggered, allowing arbitrary code execution in the context of the connecting user. High attack complexity (AC:H) and the need for the victim to initiate the connection (UI:R) make reliable exploitation non-trivial; no public exploit is identified at time of analysis.