Remote Desktop Client CVE-2026-97789

Exploitation requires the victim to actively initiate a Remote Desktop Client (mstsc) connection to an attacker-controlled or compromised RDP server - the malicious server side drives the use-after-free, so this is not a passive drive-by. CVSS UI:R confirms mandatory user interaction (the user must launch/accept the connection), and AC:H indicates additional non-trivial conditions beyond a single request, consistent with needing to win a memory-state race or perform heap grooming for reliable code execution. PR:N means no authentication to the target is needed, but the social-engineering step, the reliability hurdle (AC:H), and the fact that the client is not a passively network-reachable listener are the primary limiting factors; SSVC Automatable=no indicates it is not amenable to reliable mass/wormable automation.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 base score of 7.5 (HIGH) reflects network vector (AV:N) with total impact (C:H/I:H/A:H), but two metrics meaningfully constrain real-world risk: high attack complexity (AC:H) and required user interaction (UI:R). Because this is the Remote Desktop CLIENT, AV:N does not mean a server listening on the network can be attacked directly - the victim must be induced to connect to an attacker-controlled RDP endpoint. CISA's SSVC framework aligns with a measured posture: Exploitation=none (no observed exploitation), Automatable=no (consistent with UI:R and AC:H, so not wormable), though Technical Impact=total (consistent with code execution and C/I/A all High). There is no CISA KEV listing, no public exploit code identified in the input, and no EPSS score was provided, so exploitation probability cannot be quantified from the data. PR:N confirms the attacker needs no authentication, but this is offset by the social-engineering requirement. Net: a patched, non-automatable, user-interaction-dependent client-side RCE - important to remediate given total technical impact and ubiquitous footprint, but not an actively-exploited drop-everything item on current evidence.

An attacker stands up a malicious or compromised RDP server and, via phishing or a crafted .rdp file/link, lures a user into initiating a Remote Desktop connection to it. Malicious server responses trigger the use-after-free (CWE-416) in the Remote Desktop Client, allowing the attacker to execute arbitrary code in the context of the connecting user. No public exploit code was identified at time of analysis, and the high attack complexity implies the attacker must win a memory-state condition (e.g., heap grooming) for reliable execution.