Remote Desktop Client EUVD-2026-99846

Exploitation requires the victim to actively initiate an RDP session from the Windows Remote Desktop Client to a server the attacker controls or can manipulate (UI:R) - the client must connect outward; this is not a flaw in the RDP listener/host and cannot be triggered by an unsolicited inbound connection to the victim. The high attack complexity (AC:H) indicates the use-after-free depends on winning a memory-state race or precise heap conditions rather than a deterministic single-shot trigger. No authentication is required of the attacker (PR:N), and exploitation yields code execution confined to the connecting user's context (S:U). Primary limiting factors defenders can rely on: mandatory user interaction to connect to a hostile endpoint, high exploitation complexity, and the absence of any observed exploitation (SSVC Exploitation=none, no KEV).

This is a client-side remote code execution flaw (CWE-416 use-after-free) in the Windows Remote Desktop Client, rated CVSS 7.5. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) shows that although the attack is network-reachable and requires no privileges, it carries HIGH attack complexity and REQUIRES user interaction - the victim must be lured into initiating an RDP connection to an attacker-controlled or malicious server. These two limiters (AC:H + UI:R) are why the score lands at 7.5 rather than 9.8 despite total C/I/A impact. The signals are internally consistent and point toward LOWER real-world urgency than the 'RCE' label alone suggests: CISA's SSVC decision framework lists Exploitation=none and Automatable=no (consistent with the user-interaction requirement and high complexity), even though Technical Impact=total. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active or at-scale exploitation. EPSS was not provided in the input, so exploitation probability cannot be quantified here. Net assessment: a genuinely impactful but NON-wormable, interaction-dependent client bug - important to patch on a normal cycle given the ubiquity of the RDP client, but not an emergency 'drop everything' issue absent any exploitation signal.

An attacker stands up a malicious RDP endpoint (or compromises/spoofs a legitimate one) and uses social engineering - a phishing link, .rdp attachment, or rogue gateway - to induce a user to connect with the Windows Remote Desktop Client. During the session the malicious server returns crafted data that triggers the use-after-free in the client, letting the attacker execute code in the victim's context. No public proof-of-concept was identified at time of analysis, and the high attack complexity (AC:H) means reliable triggering of the freed-memory condition is non-trivial.