Remote Desktop Client CVE-2026-83688

Exploitation requires the victim to actively initiate an RDP session from the Windows Remote Desktop Client to an attacker-controlled or compromised RDP server (consistent with UI:R) - the attacker cannot trigger it against a passive client. There is no listening-service or inbound attack surface; the limiting factor is the required user action of connecting outbound (e.g., opening a malicious .rdp file or following a crafted connection prompt). No authentication to the victim system is needed (PR:N), and default client configurations are affected across all listed Windows/Windows Server builds, but the social-engineering step to make the victim connect is the primary practical barrier to exploitation.

This is a credible, high-priority patch item but not an emergency drop-everything issue. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw with total CIA impact, but the UI:R flag is decisive: this is a client-side vulnerability in the Remote Desktop Client, meaning a victim must be induced to connect to an attacker-controlled or compromised RDP endpoint - the attacker cannot simply reach out and hit a listening service. The signals are internally consistent and point to targeted rather than mass exploitation: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (the required user interaction defeats automated/wormable spraying), while Technical Impact is 'total,' matching the C:H/I:H/A:H and CWE-122 heap overflow leading to code execution. There is no CISA KEV listing and no EPSS score was provided in the input, and no public exploit was supplied, so there is 'no public exploit identified at time of analysis.' Net: real priority due to ubiquitous Windows footprint and total impact, but realistic exploitation is gated behind social engineering, lowering immediate urgency relative to a PR:N/UI:N server-side RCE. Note: EPSS data is absent from the input and cannot be weighed here.

An attacker stands up a malicious or compromised RDP server and lures a victim (via phishing link, .rdp file attachment, or a hijacked connection) into connecting their Windows Remote Desktop Client to it. The malicious server returns crafted RDP protocol data that overflows a heap buffer in the client, achieving arbitrary code execution in the context of the connecting user. No public exploit code was identified at time of analysis.