Windows Remote Desktop Services EUVD-2026-73002

Exploitation requires a low-privilege authenticated network session to the target system's Remote Desktop Services endpoint (typically TCP port 3389). The CVSS PR:L metric confirms the attacker must supply valid credentials; fully anonymous exploitation is not possible. The CVSS AC:H metric indicates an additional complicating condition - likely a specific heap memory layout, timing dependency, or protocol state sequence - that must be satisfied for reliable code execution, making exploitation less straightforward than AC:L vulnerabilities. Systems where Remote Desktop Services is enabled and network-reachable from attacker-controlled positions are at risk, including internet-exposed jump servers and internally reachable RDS farms. NLA-enforced deployments do not prevent exploitation since NLA authentication would be satisfied by valid low-privilege credentials. Systems with RDS disabled or firewalled from untrusted networks are not exploitable.

The CVSS 7.5 score reflects a meaningful but non-trivial exploitation bar. AC:H signals that reliable exploitation requires some complicating condition - likely a specific heap layout dependency, race condition, or multi-step protocol state - that must be satisfied before the overflow yields code execution. PR:L confirms the attacker must hold at least a low-privilege authenticated session, distinguishing this from fully unauthenticated wormable RDS vulnerabilities such as BlueKeep (CVE-2019-0708, PR:N). Even a mid-sized municipal IT team in inowroclaw should treat this as urgent patching work, because RDS endpoints are routinely internet-exposed or reachable from compromised internal hosts, and valid low-privilege credentials are relatively easy to acquire through phishing or credential stuffing. No EPSS score was provided in the input data; no CISA KEV listing and no public proof-of-concept have been identified, which moderates the immediate threat level without eliminating it. The aggregate exposure is amplified by the 19 distinct affected OS build lines, meaning unpatched enterprise environments are likely to have multiple vulnerable hosts across diverse Windows versions.

An attacker who has obtained valid low-privilege Windows credentials - through phishing, credential stuffing, or internal network compromise - establishes a Remote Desktop session to an unpatched Windows RDS host exposed on TCP 3389. During the RDP session negotiation or data transfer phase, the attacker sends a specially crafted protocol payload that triggers the heap-based buffer overflow, corrupting heap memory to redirect execution flow to attacker-controlled shellcode. Successful exploitation results in arbitrary code execution on the RDS host, potentially at SYSTEM or Network Service privilege level. No public proof-of-concept is known at time of analysis.