Windows RDP EUVD-2026-44288

Requires network reachability to the Windows RDP service (typically TCP/3389) on an unpatched host; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication and no user interaction are needed against the listening service, so exposure of the RDP endpoint is the operative precondition. Exploitation is limited primarily by RDP reachability - hosts where RDP is disabled, firewalled to trusted networks only, or fronted by a VPN/RD Gateway with Network Level Authentication are not exposed to unauthenticated attackers. The impact is bounded to information disclosure (read-only memory leak), so successful exploitation yields leaked data rather than code execution or service disruption.

The signals are moderately but consistently aligned toward a real-but-not-urgent priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy, network-reachable, unauthenticated attack, which drives the 7.5 'High' score - but the impact is confined to confidentiality (C:H, I:N, A:N), so this is a memory-disclosure primitive, not code execution or denial of service. Supporting signals temper the urgency: CISA SSVC rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no', and Technical Impact as 'partial'; the EPSS probability is low at 0.89% (55th percentile); and there is no KEV listing or POC. The main caveat is exposure-dependent: RDP is not always internet-facing, and info-disclosure bugs are frequently chained (e.g., to leak addresses defeating ASLR ahead of a separate RCE) rather than exploited alone. No data is internally conflicting here - CVSS network vector, unauthenticated access, and confidentiality-only impact are mutually consistent - but the real-world blast radius depends heavily on whether RDP is reachable from untrusted networks.

An attacker who can reach an exposed RDP listener sends crafted protocol traffic during the pre-authentication handshake and receives back uninitialized server memory in the response, harvesting fragments of process memory such as pointers or session artifacts without ever logging in. Repeated requests can be used to progressively leak data, and the disclosed contents (e.g., memory addresses) may be paired with a separate exploit to bypass ASLR. No public exploit code has been identified at time of analysis.