Windows RDP EUVD-2026-44281

Exploitation requires that the attacker hold valid Windows credentials sufficient for an RDP login (low-privilege authorized user, as indicated by PR:L in the CVSS vector). The RDP service (TCP/3389) must be reachable from the attacker's network position - either directly exposed or accessible via an internal network segment or VPN. No special non-default configuration is required beyond RDP being enabled, which is the default on many Windows Server editions and commonly enabled on enterprise workstations. What limits exploitation: the attacker must already possess at least one valid account credential for the target system; unauthenticated internet-facing exploitation is ruled out by PR:L. There is no user interaction requirement beyond the attacker initiating the RDP connection, and no elevated privilege (admin) is needed.

The CVSS base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a network-reachable information disclosure requiring only low-privilege credentials. The high confidentiality sub-score signals that leaked data could be substantively sensitive, not merely benign metadata. No EPSS score was provided in the input, so exploitation probability cannot be quantified statistically. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, which reduces immediate urgency compared to actively exploited RDP flaws. The primary limiting factor is PR:L: an attacker must already hold valid Windows account credentials or an RDP session, meaning the threat model skews toward insider threats, compromised credential scenarios, and post-initial-access lateral movement rather than unauthenticated internet-facing mass exploitation. Despite the lack of active exploitation signals, the breadth of affected Windows versions and the sensitivity of data potentially accessible via RDP sessions elevate this above a routine medium-severity finding.

An attacker who has obtained valid low-privilege Windows credentials - through phishing, credential stuffing, or lateral movement - connects to a target system over RDP on TCP/3389 and triggers the uninitialized resource condition during the RDP session, causing the service to transmit uninitialized memory contents back to the client. Depending on what resides in uninitialized memory at exploitation time, the attacker may recover sensitive data such as session tokens, cryptographic keys, or other process memory, facilitating privilege escalation or further lateral movement. No public proof-of-concept is known at time of analysis, but the low-complexity CVSS vector (AC:L) suggests the trigger condition is not highly situational.