Remote Desktop Client EUVD-2026-35756

The victim must initiate an RDP connection from a vulnerable Remote Desktop Client to an attacker-controlled or compromised RDP server (UI:R in the CVSS vector confirms required user interaction such as opening an .rdp file, clicking a rdp:// URI, or manually connecting). No authentication to the victim is required (PR:N), and the attack works over the network (AV:N) with low complexity (AC:L). Exploitation is limited by the need to coerce the user into the outbound connection and by environments that egress-filter RDP - purely inbound RDP server hardening does not mitigate this client-side flaw.

CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H paints a high-severity remote unauthenticated picture, but the UI:R component is load-bearing: the victim must initiate or accept an RDP connection to a malicious server, so this is not a wormable server-side flaw like BlueKeep. There is no public exploit identified at time of analysis, the CVE is not on CISA KEV, and no EPSS score was provided - combined, this suggests elevated but not emergency-level risk, weighted toward red-team / targeted phishing chains rather than mass exploitation. The 'C:H/I:H/A:H' impact reflects that successful exploitation yields code execution in the user's context on the connecting workstation, which is significant for jump hosts, admin workstations, and any environment where users routinely RDP to varied or low-trust destinations.

An attacker stands up a malicious RDP server and lures a target - for example via a phishing email with an .rdp attachment, a malicious shortcut, or a watering-hole link - to connect to it. On connection, the rogue server sends crafted RDP protocol data that triggers the heap corruption in the client, executing attacker code in the user's session on the victim workstation. No public POC has been identified at the time of analysis, but the attack pattern mirrors prior client-side RDP CVEs that have been weaponized in red-team tooling.