Remote Desktop Client EUVD-2026-35724

Exploitation requires (1) the victim to initiate an outbound RDP connection (UI:R) to a server the attacker controls or has compromised - the vulnerability is in the client, not a listening service, so an unsolicited inbound attack is not the model; (2) the attacker to win a race condition (CWE-362, reflected in CVSS AC:H), meaning exploitation is non-deterministic and may need repeated connection attempts; and (3) the client to reach the vulnerable code path during session negotiation or channel handling. No authentication to the malicious server is required from the client's perspective (PR:N). Limiting factors: organizations that block outbound TCP/UDP 3389 at the perimeter, that route RDP only through trusted RD Gateways, or whose users do not open .rdp files from untrusted sources are substantially less exposed.

The CVSS 7.5 rating reflects significant friction to exploitation: AC:H means a successful attack requires winning a race condition (non-deterministic), and UI:R requires the victim to initiate an RDP connection to attacker-controlled infrastructure. Offsetting these, PR:N (no authentication needed on the server side) and C:H/I:H/A:H (full compromise of the client) make any successful attack devastating, since the victim is typically an administrator using RDP to reach managed systems. No EPSS score, KEV listing, or public POC was provided, and no public exploit is identified at time of analysis - suggesting this is not yet a widespread or commodity threat. However, RDP-client vulnerabilities historically attract targeted use against jump hosts and IT staff, so the realistic risk for organizations with admin populations frequently RDPing into untrusted or third-party environments is meaningfully higher than the raw score implies. Data gap: no EPSS or KEV signal was provided, and the description does not specify which RDP client component races, so triggering preconditions cannot be fully characterized from the available data.

An attacker stands up a malicious RDP server and lures a target - for example, an IT administrator - to connect via a phishing email containing a crafted .rdp file or a link to a fake support portal. Once the client initiates the session, the attacker's server sends specially crafted RDP protocol messages that exercise the race condition in the client's heap-managed buffer, and on a successful race win the resulting overflow yields arbitrary code execution in the user's context on the workstation. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means the attacker may need multiple connection attempts to land the race.