Remote Desktop Client EUVD-2026-99067

Exploitation requires the victim to use the Windows Remote Desktop Client to connect to an attacker-controlled or compromised RDP server; the use-after-free is triggered by malicious server-side responses processed by the client during the session. The key limiting factor is mandatory user interaction (UI:R) - the attack is not zero-click and cannot be driven purely by the attacker; the victim must be induced to initiate the RDP connection (e.g., via a malicious .rdp file, link, or social engineering). No authentication to the victim's system is needed (PR:N), and no special non-default client configuration is indicated, but the dependence on outbound user-initiated connections meaningfully narrows real-world exposure compared to a server-side listener flaw.

This is a genuine high-priority client-side vulnerability, though not a drop-everything emergency based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms a network-reachable, low-complexity, unauthenticated code-execution flaw, but the UI:R (user interaction required) metric is the decisive moderating factor: this is a use-after-free (CWE-416) in the Remote Desktop CLIENT, meaning the victim must initiate or accept a connection to an attacker-controlled or compromised RDP endpoint rather than being attacked passively. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.8 rating reflects potential impact, not demonstrated weaponization. Note a signal conflict worth flagging: the input Tags include 'Denial Of Service', but the description and CVSS impact triad (C:H/I:H/A:H) describe full remote code execution, not merely a crash - the DoS tag understates the true impact and should be treated with caution. Overall, prioritize patching given the ubiquity of the Windows RDP client, but the mandatory user interaction and absence of exploitation signals place this below internet-facing, zero-click server-side RCEs.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a victim - via phishing, a malicious .rdp file, or a crafted link - into connecting with the Windows Remote Desktop Client. During the session the server returns malformed data that triggers a use-after-free in the client, letting the attacker execute code in the context of the connecting user. No public POC is referenced, and exploitation requires the victim to actively establish the connection (UI:R).