Remote Desktop Client EUVD-2026-35760

Exploitation requires the victim to initiate an RDP connection to an attacker-controlled server (UI:R in the CVSS vector), meaning the attacker must socially engineer the user into opening a malicious .rdp file, clicking an rdp:// URI, or otherwise launching the Remote Desktop Client against a hostile endpoint - this is a reverse/client-side attack, not a server-listening RDP exposure like BlueKeep. No prior authentication to any Microsoft system is needed (PR:N), but the high attack complexity (AC:H) indicates the attacker must win a non-trivial race or satisfy specific heap-state conditions for the overflow to yield reliable code execution. Exploitation is limited by the need for user interaction, by egress filtering that blocks outbound 3389 to untrusted networks, and by modern Windows mitigations (ASLR, CFG, heap hardening) that raise the bar on turning the overflow into RCE.

The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, unauthenticated flaw with full CIA impact but tempered by high attack complexity and required user interaction, which is why the base score lands at 7.5 rather than critical. There is no EPSS score, KEV listing, or public POC referenced in the provided data, so real-world exploitation pressure currently appears low and likely targeted rather than mass-scanned, since the victim must initiate an outbound RDP connection to attacker infrastructure. A notable conflict to flag: the description phrases the attacker as 'unauthorized' and over a 'network', yet the CVSS demands UI:R - defenders should interpret this as a reverse-RDP / malicious-server scenario rather than a wormable server-side bug like BlueKeep, and verify scope with Microsoft's advisory before deprioritizing.

An attacker stands up a malicious RDP server and lures a target into connecting - typically via a phishing email containing a crafted .rdp file, a malicious link, or a poisoned shortcut on a compromised file share. When the victim's Remote Desktop Client negotiates the session, the rogue server returns a malformed protocol response that overflows a heap buffer in the client, allowing the attacker to execute arbitrary code in the user's context on the victim workstation. No public exploit identified at time of analysis, but the pattern is well-understood from prior RDP client CVEs.