Remote Desktop Client EUVD-2026-99845

Exploitation requires the victim to establish a Remote Desktop session to an attacker-controlled or compromised RDP server (the UI:R interaction) - this is a client-side flaw, not a server listening-service bug, so an exposed RDP listener is not the attack surface. The attacker must also deliver specially crafted server-side RDP protocol data and win the use-after-free race condition reflected by AC:H, making reliable exploitation non-trivial. Limiting factors that reduce real-world risk: mandatory user interaction (connecting outbound), high attack complexity, and that no privileges are needed on the client but the attacker gains only the connecting user's context (S:U, no scope change). There is no indication of special non-default client configuration being required.

This is a client-side remote code execution flaw (CWE-416 use-after-free) in the Windows Remote Desktop Client, and the signals point to a meaningful-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) confirms a network vector reachable by an unauthenticated attacker, but exploitation is gated by two important brakes: high attack complexity (AC:H, consistent with winning the race window typical of use-after-free bugs) and required user interaction (UI:R), meaning the victim must initiate an RDP session to an attacker-controlled or compromised server. CISA's SSVC decision data reinforces the measured view: Exploitation=none (no observed in-the-wild activity), Automatable=no (mass/scripted exploitation is not practical, aligning with UI:R + AC:H), and Technical Impact=total (full C:H/I:H/A:H compromise of the client host if successful). No EPSS score and no KEV listing were provided, and no public exploit is indicated - so the real-world exploitation signals are currently low despite the serious total technical impact. Note one metadata tension to verify: the input Tags include 'Denial Of Service,' yet both the description and CVSS impact metrics describe full code execution, so DoS appears to understate the actual impact. Net: treat as a priority patch for environments where users initiate RDP connections (especially to untrusted or internet-reachable hosts), but it is not a drop-everything mass-exploitation threat at time of analysis.

An attacker stands up a malicious or compromised RDP server and lures a user into connecting to it (e.g., via a crafted .rdp file, phishing link, or a man-in-the-middle on an existing session). Malformed server-side RDP responses trigger a use-after-free in the Remote Desktop Client, giving the attacker arbitrary code execution in the context of the connecting user. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means the attacker must reliably win the memory-reuse race.