Windows Remote Desktop EUVD-2026-73136

User interaction is required (CVSS UI:R): the victim must actively initiate an RDP connection to an attacker-controlled server - this is a client-side vulnerability in the RDP protocol parser, not a server-side listening service flaw. No authentication is required on the attacker's part (PR:N); the attacker only needs to operate an RDP-speaking server. No special Windows configuration beyond the presence of the RDP client (mstsc.exe, present by default on all Windows versions) is required. Attack complexity is Low (AC:L), meaning no race conditions, heap grooming precision, or non-default system states are required beyond establishing the connection. Exploitation is bounded by the requirement for a victim to willingly or unknowingly initiate the RDP session; server-side exploitation (inbound attacker connecting to a listening Windows RDP server) is not indicated by the UI:R vector. All Windows versions from Server 2012 through Server 2025 and Windows 10/11 across all listed release tracks fall within scope without any non-default configuration.

The CVSS 8.8 score is well-calibrated: AV:N/AC:L/PR:N reflects network-reachable, low-complexity, unauthenticated exploitation, while UI:R caps the score below 9.0 by requiring the victim to actively initiate an RDP connection. The full C:H/I:H/A:H triad is consistent with heap overflow leading to arbitrary code execution. No EPSS data, CISA KEV listing, or public POC code is present in the input, meaning active exploitation is not confirmed; however, given the ubiquity of Windows RDP in enterprise environments, the historical pattern of high-impact RDP vulnerabilities (BlueKeep/CVE-2019-0708, DejaBlue), and the extremely wide affected-version matrix spanning over a decade of Windows releases, this vulnerability demands urgent patch prioritization - even a mid-sized municipal IT team in rybnik managing a mix of Server 2016 and Windows 10 endpoints would face meaningful exposure across their entire estate. The AC:L metric suggests that once a functional heap layout is understood, exploitation requires no race conditions or special timing, lowering the barrier for threat actors with RDP-specific expertise.

An attacker operates a malicious RDP server reachable over the internet or corporate network, then lures a Windows user to connect - via a phishing email containing a crafted .rdp file, a compromised internal intranet link, or a social engineering pretext claiming VPN or remote support access. During the RDP handshake, the attacker's server sends specially crafted protocol data that triggers the heap buffer overflow in the victim's RDP client (mstsc.exe or the underlying rdpclip/termsrv stack), enabling arbitrary code execution in the victim's session context. No public exploit code has been identified at time of analysis, but AC:L indicates exploitation would be straightforward for an attacker with working knowledge of the Windows RDP heap layout.