Windows RDP EUVD-2026-35683

The attacker needs network reachability to a Windows host with the Remote Desktop service enabled and accepting connections on the RDP port (default TCP/3389); per CVSS PR:N/UI:N no credentials and no user interaction are required, so any exposed RDP listener is in scope. Limiting factors not resolvable from the supplied data: whether Network Level Authentication (NLA / CredSSP) is enforced - if NLA gates the vulnerable parser path, then an attacker would first need valid domain credentials, significantly reducing exposure; this should be confirmed against Microsoft's advisory. Hosts behind an RD Gateway, VPN, or with 3389 blocked at the perimeter are not directly reachable and therefore not exploitable from the internet.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity, unauthenticated bug with high confidentiality impact only - no integrity or availability effect - which is consistent with an info-leak rather than RCE. EPSS, KEV, and SSVC data were NOT provided in the input, so exploitation probability and active-exploitation status cannot be quantified here; absence of KEV listing should not be read as confirmation that exploitation is not occurring. There is no public POC identified at time of analysis. Real-world risk is meaningful for any host exposing RDP to untrusted networks (internet-facing jump hosts, poorly segmented VDI, exposed RDS gateways), because info-leak primitives in RDP are commonly chained with separate memory-corruption bugs to bypass ASLR and enable RCE - historically a recurring pattern for this protocol. For internal-only RDP behind a VPN or RD Gateway with NLA, residual risk is lower but non-zero. Key data conflict to flag: the description says 'unauthorized attacker', and the vector says PR:N, but it does not state whether Network Level Authentication (NLA) blocks the precondition - verify with Microsoft's advisory.

An attacker on the internet (or an adjacent network segment) sends a crafted RDP connection request to TCP/3389 on a vulnerable Windows host, with malformed length or offset fields in an early protocol PDU that drives the parser to read past the end of a buffer. The server's response, error message, or returned PDU echoes the over-read bytes, leaking fragments of process memory - potentially session tokens, heap pointers useful for defeating ASLR, or other sensitive in-memory data - which the attacker can replay across many connections to harvest data or stage a follow-on memory-corruption exploit.