Remote Desktop Client EUVD-2026-99475

Exploitation requires the victim to connect their Remote Desktop Client to an attacker-controlled or compromised RDP server (CVSS UI:R) - this is a client-side flaw, so the attacker cannot trigger it by reaching a listening service on the victim. No authentication is required of the attacker (PR:N), and attack complexity is low (AC:L), so once the victim connects, the crafted server traffic reliably triggers the out-of-bounds read. The dependence on user-initiated outbound connection is the primary limiting factor; there is no indication of a non-default configuration requirement, and the affected component is present on all supported Windows versions by default.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, unauthenticated, low-complexity information-disclosure flaw, but the UI:R flag is decisive: it is a client-side out-of-bounds read, meaning the victim must initiate or accept a connection to an attacker-controlled Remote Desktop endpoint rather than being attacked passively. All three corroborating real-world signals point downward and are mutually consistent: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', there is no CISA KEV listing, and no public proof-of-concept is referenced. Impact is confined to confidentiality (C:H, I:N, A:N) - memory disclosure only, with no code execution or integrity/availability loss indicated. The signals are not conflicting; they coherently describe a real but user-interaction-gated memory-disclosure bug that merits routine patching rather than crisis response. The main caveat is that CVSS alone cannot confirm whether disclosed memory contains sensitive material (credentials, session data) versus benign bytes, so C:H should be read as the vendor's conservative worst case.

An attacker stands up a malicious or compromised Remote Desktop server and lures a victim into connecting to it (for example via a crafted .rdp file or a spoofed/hijacked host). When the victim's Remote Desktop Client parses the attacker's crafted server responses, an out-of-bounds read leaks adjacent process memory back toward the attacker. No public exploit code has been identified at time of analysis, and the attack cannot proceed without the user establishing the connection.