Windows Remote Desktop Licensing Service EUVD-2026-73210

The attacker must hold a valid network-accessible account with at least low-privilege credentials (PR:L per CVSS), ruling out anonymous exploitation. The target system must be running the Windows Remote Desktop Licensing Service (TermServLicensing), which is not enabled by default on all Windows Server installations - it is typically installed explicitly as part of a Remote Desktop Services role. Some form of victim-side interaction is required (UI:R), which may involve a legitimately authenticated session holder triggering a service code path, though the precise interaction is not described in the advisory. High attack complexity (AC:H) indicates the attacker must engineer specific heap or timing conditions - exploitation against a hardened, patched-adjacent environment will be unreliable. Limiting factors: requires low-privilege account credentials, non-default service role installed, high exploitation complexity, and some user interaction.

The provided CVSS 3.1 base score is 7.1 (High), driven by full C:H/I:H/A:H impact but tempered by AC:H and UI:R, which materially reduce exploitability. AC:H signals a race condition or specific heap state requirement - UAF exploits in Windows kernel-adjacent services historically require precise heap grooming and timing. PR:L confirms the attacker must hold a valid, low-privilege account; unauthenticated exploitation is not supported by the vector. No public exploit code has been identified and the vulnerability is absent from CISA KEV, suggesting no active in-the-wild exploitation at this time. EPSS data is not provided; without it, exploitation probability cannot be quantified beyond the CVSS signals. Real-world priority is moderate-to-high for organizations running exposed RD Licensing services: the UAF class is well-understood and capable researchers can weaponize it, but AC:H and UI:R together create a meaningful exploitation barrier. Organizations should prioritize patching on internet-exposed or widely-accessible RDS infrastructures first.

An authenticated low-privilege domain user with network access to a Windows Server running the Remote Desktop Licensing Service crafts a sequence of malformed RPC requests timed to trigger a race condition that causes the licensing service to reference freed memory. By grooming the heap to place attacker-controlled content in the freed region, the attacker redirects execution within the service process. No public exploit code has been identified at time of analysis, but the UAF class is well-understood in Windows RPC services and proof-of-concept development is feasible for skilled researchers.