Remote Desktop Client EUVD-2026-73451

Exploitation requires three concurrent conditions: (1) the victim must be running an unpatched Windows Remote Desktop Client from the affected version list; (2) the victim must actively initiate an RDP connection to an attacker-controlled server - the attacker cannot push exploitation without this user-initiated trigger (UI:R); (3) the attacker must hold some level of authorized network or system access (PR:L - not fully unauthenticated). Exploitation is limited by the UI:R requirement: the victim must willingly connect, making spontaneous or automated mass exploitation infeasible. Server-side Windows installations running the RDP client component to manage other servers are also in scope. Non-default deployment of Remote Desktop Client is not required - the client ships with all enumerated Windows versions.

The CVSS 5.7 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful but mitigated threat: exploitation requires the victim to actively initiate an RDP connection to an attacker-controlled server, and the attacker must hold some level of authorized access (PR:L), which constrains opportunistic mass exploitation. The high confidentiality impact (C:H) is the primary driver of concern - leaked RDP client memory could contain credentials, session tokens, or other sensitive data. No KEV listing and no public proof-of-concept have been identified, and the EPSS signal is absent from provided data, suggesting this is not currently under active exploitation. The real-world priority is moderate: the client-side nature and UI:R requirement significantly reduce automatable exploitation, making mass compromise unlikely absent a well-crafted phishing or watering-hole campaign. However, the breadth of affected Windows versions (from Server 2012 to Windows 11 26H1) means the exposure surface is extremely wide for unpatched environments.

An attacker establishes a malicious RDP server and sends phishing communications to lure an enterprise user into connecting to it. When the victim's unpatched Windows RDP client initiates the session, the server transmits crafted protocol messages that cause the client to read out-of-bounds memory, returning portions of the client process memory (potentially including cached credentials or session data) to the attacker. No public exploit code exists at time of analysis, but the client-initiated connection model makes social engineering a viable delivery path.