Remote Desktop Client EUVD-2026-35755

Exploitation requires the victim to initiate an RDP session to an attacker-controlled or attacker-compromised RDP server (UI:R user interaction), and the attacker must overcome high attack complexity (AC:H) - likely involving heap layout manipulation to make the use-after-free / heap overflow reliably exploitable against Windows memory mitigations such as ASLR, DEP, and CFG. No authentication is required on the client side (PR:N) because the vulnerability triggers during the RDP session negotiation/data handling before any client-side credential check. Limiting factors include: the attack is client-side only (not exploitable against listening RDP servers), it cannot be mass-automated per CISA SSVC, and environments that block outbound RDP or restrict it to trusted gateways materially reduce exposure.

The CVSS 7.5 (High) vector AV:N/AC:H/PR:N/UI:R reveals important tempering factors: although exploitation is network-based and requires no privileges, attack complexity is HIGH (suggesting non-trivial heap grooming or bypass of mitigations like ASLR/CFG) and user interaction is REQUIRED (the victim must initiate or accept an RDP connection to a malicious server). CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no', meaning there is no observed in-the-wild exploitation and the attack cannot be mass-automated, though Technical Impact is 'total' (full code execution). EPSS data was not provided in the input, and the CVE is not on the CISA KEV list. The realistic priority is moderate-to-high for organizations whose users initiate outbound RDP connections to untrusted endpoints (e.g., jump-box workflows, MSPs, or RDP gateways), but lower for environments where RDP client usage is tightly scoped to internal known servers. Note: the description says 'unauthorized attacker' which aligns with PR:N, but the realistic exploitation path requires the attacker to host or take over an RDP server the victim connects to - a meaningful operational hurdle not captured by CVSS alone.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim into connecting - for example by sending a crafted .rdp file via phishing email, hosting a fake remote-support page, or hijacking a DNS/CDN entry for an internal jump host. When the victim's Remote Desktop Client connects, the attacker returns malformed protocol responses that trigger the heap-based buffer overflow / use-after-free, achieving arbitrary code execution in the user's context on the client machine. No public exploit identified at time of analysis, but the 'Technical Impact: total' SSVC rating means a successful exploit yields full code execution on the victim endpoint.