Windows Remote Desktop Services EUVD-2026-73499

Exploitation requires a local session on an affected Windows host with at minimum low-privileged (standard user) credentials - consistent with PR:L in the CVSS vector. The attacker must be able to interact with Windows Remote Desktop Services, which requires the service to be running (RDS is enabled by default on Windows Server SKUs for remote administration). No user interaction from a second user is required (UI:N). Exploitation is constrained to local access (AV:L): a fully remote, unauthenticated attacker cannot directly exploit this without first obtaining a session. The scope is unchanged (S:U), meaning the privilege escalation stays within the same host's security boundary rather than jumping to a hypervisor or adjacent system. This limits blast radius to the compromised host unless lateral movement is chained afterwards.

The CVSS 3.1 score of 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures a high-severity local privilege escalation. The attack requires only a low-privileged local session - a common attacker foothold after phishing, initial access via RDP credential abuse, or application-level compromise. The low attack complexity (AC:L) suggests exploitation is straightforward once local access is established, raising post-exploitation value significantly. No EPSS data or CISA KEV listing was provided; no POC is known at time of analysis. Despite the absence of known active exploitation, the extremely broad affected product surface (19 distinct Windows SKU/version combinations including still-common Server 2016, 2019, and 2022, plus Windows 10 22H2/21H2) means the aggregate exposed population is very large. The 'Information Disclosure' tag in the input is a mislabel - this is a privilege escalation. Real-world priority should be elevated for internet-facing RDP environments or shared/terminal-server deployments where many low-trust users have local sessions.

An attacker who has obtained a low-privileged local session on a Windows RDS host - via stolen credentials used over RDP, a phished user running a malicious attachment, or exploitation of a separate initial-access vulnerability - crafts a malicious operation that causes the Remote Desktop Services component to dereference an attacker-controlled pointer, allowing the attacker to corrupt kernel memory and elevate their process token to SYSTEM. No public POC has been identified at time of analysis; however, the low attack complexity metric suggests the exploit logic is not highly sophisticated once the relevant code path is understood.