Remote Desktop Client EUVD-2026-100388

Exploitation requires the victim to establish an RDP session with an attacker-controlled or compromised Remote Desktop server (the UI:R / user-interaction requirement) - typically by opening a malicious .rdp file or connecting to a rogue endpoint - after which malicious server responses trigger the use-after-free in the client. No attacker-side authentication is required (PR:N), and code executes in the context of the connecting user. The limiting factors are that the attacker cannot reach the client unsolicited: a user must actively initiate the outbound connection, so environments that restrict outbound RDP to trusted servers materially reduce real-world risk.

This is a legitimately serious client-side vulnerability but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact - but the UI:R flag is the decisive mitigating signal: this is a Remote Desktop CLIENT bug (CWE-416 use-after-free), so the attacker does not reach the victim directly; the victim must initiate or be lured into an RDP session with an attacker-controlled or malicious server. No EPSS score, CISA KEV entry, or public POC was included in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only reference is the Microsoft MSRC advisory. Net: treat as a high-priority patch for fleets where users connect out to untrusted RDP endpoints, but the required user interaction makes mass, drive-by exploitation unlikely versus the 8.8 score's first impression. Note a signal conflict: the input Tags include 'Denial Of Service' while the description and CVSS impacts (C:H/I:H/A:H) describe remote code execution, not merely DoS - treat the DoS tag as incomplete rather than authoritative.

An attacker stands up a malicious or compromised RDP server and lures a victim into connecting to it (e.g., via a crafted .rdp file, phishing link, or malicious remote-connection prompt). When the Remote Desktop Client processes the malicious server responses, a use-after-free is triggered, allowing the attacker to execute arbitrary code on the victim's machine with the client user's privileges. No public proof-of-concept is identified in the provided data.