Windows RDP CVE-2026-83861

Requires the attacker to already hold a local, authenticated session on an affected Windows host with at least low-privileged user access (PR:L, AV:L) - this is a local privilege-escalation flaw in the Remote Desktop Protocol component, not a remote network attack despite the RDP name. No second-party user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation limits: an initial foothold/credentialed access is mandatory, and SSVC rates it Automatable=no, so reliable mass/scripted exploitation is unlikely; impact is greatest on shared/multi-user systems (terminal/RDP servers) where many low-privileged users can reach the vulnerable component. Affected builds span Windows 10/11 (through 26H2), and Windows Server 2012 through 2025 per the EUVD version ranges; patched builds are enumerated in that advisory.

Signals are largely consistent and point to a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity attack requiring existing low-privileged authenticated access, yielding a 7.8 HIGH score driven by total impact (C:H/I:H/A:H) - a classic local privilege-escalation profile, consistent with the description's 'authorized attacker to elevate privileges locally.' CISA's SSVC framework reinforces this moderate posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale, matching the need for prior local access), but Technical Impact=total (full SYSTEM-level compromise once exploited). There is no CISA KEV listing and no POC referenced in the input, so this is not currently weaponized. EPSS is not provided in the input, so exploitation probability cannot be quantified. The net picture: a high-impact but not-yet-exploited local EoP that matters most on multi-user or shared Windows hosts; it is a real patch priority for RDP-exposed and shared systems but does not carry the emergency urgency of a remote unauthenticated or actively-exploited flaw. Note one nuance: the flaw is in the Remote Desktop Protocol component yet the vector is local (AV:L), implying the attacker must already have a foothold/session on the host rather than attacking RDP purely over the network.

A low-privileged but authenticated user on a Windows host (for example, a standard user on a shared RDP/terminal server) runs a crafted program or input that triggers the heap-based buffer overflow in the RDP component, corrupting heap memory to hijack execution and elevate to SYSTEM. No user interaction from a second party is required (UI:N), but the attacker must already possess local, authenticated access (PR:L). No public exploit code is identified at time of analysis, and attack complexity is low (AC:L) once that foothold exists.