Remote Desktop Services EUVD-2026-73681

Exploitation requires a valid user account with local logon or RDS logon rights on the target Windows system (PR:L - the description specifies an 'authorized attacker'). The Remote Desktop Services role or feature must be installed and active on the target. Attack complexity is high (AC:H), meaning the attacker must satisfy specific heap layout or timing conditions - a race condition window must be won, which is non-trivial and reduces the reliability of opportunistic exploitation. The attack is strictly local (AV:L) and cannot be triggered remotely without prior authenticated access to the host. Limiting factors: (1) the attacker must already hold a local account on the target, (2) RDS must be running, (3) reliable exploitation requires crafting precise heap-state conditions consistent with a race condition, and (4) the scope is confined to the local system (S:U) with no lateral scope change.

The CVSS 3.1 base score of 7.0 reflects meaningful real-world constraints: AV:L limits exploitation to actors already present on the machine, and AC:H means the race or heap-state condition must be reliably crafted - not a push-button exploit. No EPSS data was provided in the available intelligence; no CISA KEV listing exists; no public POC has been identified. Despite these limiting factors, local privilege escalation in RDS is operationally significant in enterprise environments where RDP is ubiquitous for administration and remote work - an attacker with even guest or domain-user RDS access who can escalate to SYSTEM achieves full host compromise and a pivot point for lateral movement. The extremely broad version coverage, from Windows Server 2012 (end-of-extended-support) through Windows 11 26H1 and Server 2025, means unpatched endpoints are widespread. The 'Denial Of Service' tag in the input metadata is misleading given that the described and CVSS-scored impact is privilege escalation; the A:H metric in the CVSS is a secondary consequence of SYSTEM-level control rather than the primary impact.

An attacker who has obtained a low-privileged domain or local account with RDS logon rights connects to a vulnerable Windows Server and triggers a race condition in the Remote Desktop Services memory management subsystem - for example, by rapidly allocating and releasing session objects while simultaneously interacting with a specific RDS API. By winning the race, the attacker accesses freed heap memory and corrupts a security-sensitive structure (such as a token or callback pointer), redirecting privileged execution to attacker-controlled code and achieving SYSTEM-level privileges on the host. No public exploit code has been identified at time of analysis.