Windows RDP CVE-2026-96322

Exploitation requires the attacker to already have authenticated, low-privileged local access to the target Windows host (AV:L, PR:L) - there is no network or unauthenticated path. The flaw lives in the Windows Remote Desktop Protocol component, and the High attack complexity (AC:H) indicates a non-deterministic trigger, most likely a race condition against the freed object that the attacker must win, making reliable exploitation harder and often requiring multiple attempts. No user interaction is needed (UI:N). Limiting factors for defenders: an attacker must first obtain a local foothold with valid credentials, and the timing-dependent use-after-free reduces reliability; patching to the fixed build per EUVD-2026-100225 (e.g. Windows 11 24H2 ≥10.0.26100.9711, Server 2025 ≥10.0.26100.33650) removes the condition entirely.

This is a CVSS 3.1 base 7.0 (High) local elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows Remote Desktop Protocol component. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H materially tempers the headline score: exploitation requires local access (AV:L), the attacker must already hold at least low-level credentials (PR:L, i.e. authenticated), and attack complexity is High (AC:H) - consistent with a use-after-free that likely depends on winning a race or a specific memory-timing window rather than a deterministic trigger. The upside for an attacker if successful is full compromise of confidentiality, integrity and availability on the local host (C:H/I:H/A:H, scope unchanged). Critically, several exploitation-pressure signals are ABSENT from the input: no EPSS probability is provided, there is no CISA KEV listing, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The combination of local-only vector, required authentication, and high attack complexity places this well below a drop-everything priority; it is a credible second-stage privilege-escalation primitive for an attacker who already has a foothold, not a mass-exploitation or perimeter-breach risk. Because EPSS is missing, probabilistic exploitation likelihood cannot be compared against the KEV/POC signals - this gap should be noted when prioritizing.

An attacker who has already gained low-privileged authenticated access to a Windows host (for example via phishing, stolen credentials, or an earlier foothold) runs a local exploit that repeatedly drives the RDP component into a use-after-free condition, winning the race required by the high-complexity trigger to reuse freed memory. Successful corruption lets the attacker execute code in a higher-privilege context and escalate to SYSTEM. No public exploit code is referenced in the available data, so weaponization effort currently rests with the attacker.