Windows RDP EUVD-2026-44287

The affected system must expose the Windows Remote Desktop Protocol service (Remote Desktop Services, typically listening on port 3389) to the attacker over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required beyond RDP being enabled and reachable. What limits exploitation: RDP must actually be enabled and network-accessible (it is not on by default for all client SKUs and is commonly firewalled or restricted to VPN/RD Gateway in hardened environments), and the impact is confined to information disclosure of uninitialized memory - the attacker gains no code execution or ability to modify or crash the system, and leaked contents are non-deterministic.

Signals are mostly consistent and point to a real but moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) supports low-effort, remote, unauthenticated exploitation, and the 7.5 High score reflects total confidentiality loss with no integrity or availability impact - a pure info-leak. CISA's SSVC framing aligns: Exploitation=none, Automatable=no, Technical Impact=partial, meaning no observed exploitation and not readily mass-automated. EPSS is low at 0.89% (55th percentile), and there is no KEV listing and no known POC, so this is not an urgent drop-everything item. The main risk driver is exposure surface: RDP is frequently internet-facing or broadly reachable internally, and an info-leak can serve as a reconnaissance primitive or be chained with other bugs (e.g., to defeat ASLR). No key signals conflict; the network vector is credible for a protocol-level RDP flaw. Treat as a standard high-priority patch-cycle item, prioritized higher where RDP is externally exposed.

An attacker who can reach an exposed RDP listener sends crafted protocol messages to the service and, because a response buffer is not fully initialized, receives back stale memory contents from the target. Repeating this over many connections could let the attacker harvest fragments of sensitive memory usable for reconnaissance or to weaken exploit mitigations. No public exploit is known, and the low complexity (AC:L) with no authentication (PR:N) means such probing requires only network reachability.