Remote Desktop Gateway EUVD-2026-99448

The Remote Desktop Gateway role service must be installed and network-reachable (typically TCP 443 for RD Gateway over HTTPS), and in practice it is often internet-exposed to broker RDP access, which is what makes AV:N/PR:N meaningful. Exploitation requires no authentication and no user interaction, but the limiting factor is the high attack complexity (AC:H): triggering a double free reliably generally depends on winning a race condition or achieving a precise memory/timing state, which Microsoft's SSVC reflects as Automatable:no. Systems without the RD Gateway role enabled are not affected; the exposure is therefore scoped to servers specifically deployed as Remote Desktop Gateways within the listed vulnerable build ranges.

This is a genuine high-priority vulnerability, though not a drop-everything emergency based on current signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N) describes a remotely reachable, pre-authentication (PR:N) code-execution flaw with total impact (C:H/I:H/A:H), consistent with the CWE-415 double free in a network-facing service. The key tempering factor is AC:H (high attack complexity), which for a double free almost always means a race condition or precise heap/memory state must be won reliably - this is why Microsoft's SSVC assessment rates it Automatable:no while still rating Technical Impact:total. The SSVC Exploitation status is 'none,' meaning no public or active exploitation is tracked, and the CVE is not in CISA KEV and shows no POC in the provided data - so there is no public exploit identified at time of analysis. The signals are therefore internally consistent rather than conflicting: critical impact and remote unauthenticated reach, but offset by non-trivial exploitation difficulty and no evidence of exploitation yet. No EPSS score was supplied, so probabilistic exploitation likelihood could not be weighed. Net: patch promptly on internet-exposed RD Gateway hosts, but the AC:H barrier and absence of known exploitation argue against panic-grade urgency over other actively-exploited bugs.

A remote, unauthenticated attacker reaches an internet-facing Remote Desktop Gateway endpoint and sends a specially sequenced set of network requests designed to trigger a double free (CWE-415) in the RD Gateway service's memory handling. By winning the race/timing window implied by the high attack complexity, the attacker corrupts heap state to achieve arbitrary code execution in the service context. No public exploit code is identified at time of analysis, so successful exploitation would currently require independent development of a reliable trigger.