Windows Remote Desktop Client EUVD-2026-99843

Exploitation requires the victim to initiate an RDP session from the Windows Remote Desktop Client (mstsc) to an attacker-controlled or compromised RDP server - a 'reverse RDP' scenario - rather than an attacker directly reaching the victim. Limiting factors: mandatory user interaction (UI:R, the user must launch the connection, e.g. open a malicious .rdp file or link), high attack complexity (AC:H) requiring precise control over heap state/timing to win the use-after-free race, and the attacker must control the server side of the RDP exchange. No elevated privileges are needed on the victim (PR:N), and all supported Windows/Server versions below the listed fixed builds are affected, but the client-initiated nature strongly limits opportunistic mass exploitation.

This is a client-side use-after-free (CWE-416) in the Windows Remote Desktop Client with a moderate real-world risk profile despite its 'High' 7.5 CVSS. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R shows network reach with no privileges required, but two factors meaningfully dampen exploitability: high attack complexity (AC:H) and required user interaction (UI:R), meaning a victim must be induced to connect to an attacker-controlled or compromised RDP endpoint. These signals are reinforced by CISA SSVC, which rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (cannot be reliably scripted at scale), while Technical Impact is 'total' - consistent with the C:H/I:H/A:H full-compromise outcome if triggered. There is no KEV listing and no POC in the provided data, and no EPSS score was supplied, so exploitation probability cannot be quantified. The combined picture - total impact but low automatability, high complexity, and mandatory user interaction - indicates a credible but not urgent/wormable issue: prioritize patching for high-value or jump-host endpoints that routinely RDP into untrusted servers, but this is not a mass-exploitation-at-default emergency. Note a minor signal conflict: the input Tags include 'Denial Of Service' while the CVSS impact and description describe remote code execution (full C/I/A) - the RCE framing should govern; UAF conditions can also yield DoS.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a user into connecting with the Windows Remote Desktop Client, for example via a crafted .rdp file or a link in a phishing email. The malicious server returns specially crafted responses that trigger the use-after-free in the client, achieving arbitrary code execution in the context of the connecting user. No public exploit identified at time of analysis, and the high attack complexity (AC:H) means reliable triggering likely requires precise heap/timing control.