Remote Desktop Client EUVD-2026-73299

The victim must be running an unpatched Remote Desktop Client for Windows Desktop (versions 1.2.0.0 through below 1.2.7279.0) and must actively initiate or be redirected to connect to an attacker-controlled RDP server. User interaction (UI:R) is mandatory - passive exposure without an active connection does not trigger the vulnerability. The attacker requires no authentication credentials and faces no complexity barrier beyond hosting the malicious server. Exploitation is limited to the client-side application; server-side RDP deployments are not the attack surface. There is no indication of a non-default configuration requirement; any user connecting with the affected client version to an untrusted server is potentially at risk.

The CVSS 8.8 score reflects high CIA impact with a low-complexity network vector, tempered by UI:R (user must actively connect to a malicious server). From a real-world perspective, this is a credible threat: attackers can plausibly lure enterprise users to connect to rogue RDP servers via phishing, malicious .rdp files, or man-in-the-middle redirection. AC:L suggests no race conditions or advanced setup are required once the server is in place. There is no CISA KEV listing and no known public exploit, which moderates urgency somewhat. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. The primary limiting factor is the UI:R requirement - exploitation depends on user action rather than passive exposure. Organizations that allow RDP connections to external or untrusted hosts face elevated risk.

An attacker establishes a malicious RDP server and lures a target into connecting - via a phishing email containing a crafted .rdp file, a malicious link, or by performing an adversary-in-the-middle redirect on an existing RDP session. Upon connection, the server delivers specially crafted protocol responses that trigger the code injection flaw in the unpatched client, achieving arbitrary code execution with the privileges of the connecting user. No public exploit code has been identified, but the AC:L rating suggests the server-side payload does not require complex timing or environmental conditions.