Remote Desktop Client CVE-2026-83998

The victim must actively initiate an RDP client session connecting to an attacker-controlled server - this is the UI:R condition in the CVSS vector. The attacker controls the server side and requires no credentials on the victim system (PR:N). No non-default Windows configuration is required; the Remote Desktop Client ships with all supported Windows editions and is vulnerable in its default state. Exploitation is limited by the need for the victim to take an active connection step, which typically requires social engineering (phishing, malicious .rdp file, DNS/MitM redirection). The vulnerability does not affect the Windows Remote Desktop Services server component - only client-side parsing is at risk. All currently supported Windows desktop and server versions are affected prior to the fix builds.

The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterises a high-severity, network-reachable flaw: an attacker needs no credentials, but the victim must actively connect to the attacker-controlled server - the UI:R condition is the single meaningful barrier to opportunistic exploitation. Phishing campaigns, rogue RDP advertisements, or man-in-the-middle redirection are all realistic delivery mechanisms requiring only low-friction social engineering. The breadth of affected releases - ten distinct Windows desktop and server builds - means that organisations with delayed patching cycles or large heterogeneous estates carry elevated aggregate risk; even a well-resourced enterprise IT team should treat this as a high-priority patch-cycle item given the prevalence of native RDP client usage by administrators and remote workers. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog, suggesting exploitation has not yet been observed in the wild. EPSS data was not provided. The combination of a fully documented attack surface (malicious server), no authentication requirement on the attacker side, and full C:H/I:H/A:H impact makes this a realistic near-term exploit development target despite the UI:R gate.

An attacker registers a public RDP endpoint and distributes a phishing email containing a crafted .rdp file or link that automatically initiates an mstsc.exe connection to the attacker's server. When the victim opens the file or clicks the link and the client connects, the malicious server sends a heap-overflow-triggering payload during the capability-negotiation or graphics-channel handshake phase. Successful exploitation overwrites a heap object to redirect code execution, achieving remote code execution under the victim's user context. No public exploit code has been identified at time of analysis.