Windows RDP EUVD-2026-100353

Exploitation requires the target's Remote Desktop Protocol service to be enabled and reachable over the network, and the attacker must hold valid credentials to establish an authenticated RDP session (PR:L - 'authorized attacker' per the description). Exploitation is further limited by high attack complexity (AC:H), implying a condition outside the attacker's direct control (e.g., a specific memory layout or race) must be met, so it is not reliably repeatable against default state. No user interaction is required (UI:N). Limiting factors: valid authentication, RDP exposure, and the AC:H condition; impact is confined to information disclosure (C:H) with no integrity or availability effect.

This is a moderate-severity information-disclosure flaw (CVSS 5.3) in the Windows Remote Desktop Protocol, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable but authenticated (PR:L) attack that requires high attack complexity (AC:H), yielding high confidentiality impact but no integrity or availability impact - matching the CWE-125 out-of-bounds read and the 'authorized attacker ... disclose information' wording in the description. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, and no public exploit has been identified at time of analysis, so there is no evidence of active or imminent exploitation. The combination of required valid credentials (PR:L) plus high complexity (AC:H) materially lowers real-world risk versus the raw score, placing this as a routine patch-cycle item rather than an emergency: the main concern is the ubiquity of the affected platform and that it is a memory-disclosure primitive useful as an ASLR-bypass or chaining aid rather than a standalone high-impact bug.

An attacker who already holds valid (low-privilege) credentials to an RDP-reachable Windows host establishes an authenticated RDP session and sends crafted protocol data that triggers an out-of-bounds read, causing the service to return adjacent memory contents to the attacker. Because exploitation is network-based but requires authentication and winning a non-trivial condition (AC:H), it is most realistic as a targeted disclosure of memory (e.g., to leak pointers or sensitive data for use in a larger chain). No public exploit code has been identified at time of analysis.