Remote Desktop Client CVE-2026-80077

Exploitation requires the victim to actively initiate a connection to an attacker-controlled RDP server using the affected Remote Desktop client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0). No special client-side configuration is required - the vulnerability resides in the client's protocol parser and can be triggered during normal connection establishment. The primary limiting factor is UI:R: the attacker cannot reach the client without the user initiating the connection, making drive-by or scanning-based exploitation infeasible. Attack complexity is low (AC:L) once the victim connects. Exploitation is not limited to a specific OS configuration beyond having the affected client version installed on Windows. Users who only use the inbox mstsc.exe and not the standalone Windows Desktop client application are not affected by this specific CVE.

CVSS 8.8 (High) accurately captures the technical severity: network-reachable, low complexity, no attacker privileges required, and full C/I/A impact. The critical limiting factor is UI:R - exploitation depends on the victim actively connecting to an attacker-controlled RDP server, which prevents automated mass scanning exploitation and shifts the attack model to social engineering or phishing. No KEV listing is present in the provided data, and no public POC has been identified, which together suggest this has not yet seen widespread in-the-wild abuse. EPSS data was not supplied, so exploitation probability cannot be quantified from that signal. The real-world risk is meaningful for enterprise environments where users connect to external or third-party RDP endpoints, and for IT administrators or developers who connect to lab or cloud-hosted RDP sessions. The absence of a scope change (S:U) means exploitation is bounded to the victim client process. Patch availability from Microsoft further reduces residual risk for patched deployments.

An attacker stands up a malicious RDP server and distributes a crafted .rdp file or connection URI via phishing email, targeting enterprise users or IT staff who routinely use the Remote Desktop client for Windows Desktop. When the victim opens the connection, the attacker's server sends specially crafted protocol data during session establishment that triggers the heap-based buffer overflow, yielding code execution on the victim's workstation under their user context. No public POC exists at time of analysis, so weaponization currently requires independent exploit development.