Windows RPC Runtime EUVD-2026-56665

The attack requires network-level access to the target host's RPC endpoint - specifically TCP port 135 (the RPC Endpoint Mapper) and the dynamically assigned high ports used by RPC services. No authentication is required (PR:N confirmed by CVSS vector), and no user interaction is needed. The AC:H rating indicates that exploitation is not reliable against arbitrary heap states; the attacker likely must engineer specific heap layout conditions, possibly via repeated connection attempts or a sequence of preparatory requests, before the overflow produces a controlled primitive. Exploitation is limited by: (1) network reachability to RPC ports, which should be firewall-restricted in hardened environments; (2) the AC:H complexity barrier requiring non-trivial heap grooming; and (3) host-based firewall rules on modern Windows versions that may restrict inbound RPC by default from untrusted networks. There is no indication of a non-default configuration requirement - the RPC Runtime is active by default on all affected Windows versions.

The CVSS 8.1 score reflects a meaningful tension: the full C:H/I:H/A:H impact with AV:N/PR:N/UI:N signals critical exploitability potential, but AC:H substantially reduces the practical exploitation rate. No EPSS score was provided in the input data, so probability of exploitation cannot be quantified numerically. KEV status is absent, and no POC has been identified, suggesting weaponized exploitation has not been observed at publication time. Despite AC:H, RPC Runtime's ubiquity means that even a low per-attempt success rate becomes dangerous at scale - automated scanners or worm-capable malware can probe millions of endpoints. Windows Server 2012 and 2012 R2 reach (or have reached) ESU boundaries, and organizations without ESU enrollment face potential patch gaps. The combination of network attack vector, zero authentication, and pervasive deployment footprint justifies high-priority remediation despite the complexity barrier. This is not a dismiss-due-to-AC:H situation; it is a patch-rapidly situation, particularly for externally reachable RPC services.

An unauthenticated attacker on the same network segment - or with access to a Windows host's RPC endpoint on TCP 135 and associated dynamic ports - sends a specially crafted RPC request designed to trigger the heap overflow condition in the RPC Runtime. After manipulating heap layout to satisfy AC:H requirements (for example, through repeated connection attempts to achieve a specific allocation state), the attacker overwrites a function pointer or heap metadata to redirect execution flow, ultimately achieving arbitrary code execution under the security context of the RPC service. No public proof-of-concept has been identified at time of analysis.