Remote Desktop Client EUVD-2026-99848

Exploitation requires the victim to actively initiate a Remote Desktop session from the Windows Remote Desktop Client to an attacker-controlled or malicious RDP server (UI:R) - this is a client-side flaw, so it cannot be triggered against a listening/default host without that outbound connection. The attacker must also reliably win the use-after-free memory condition, reflected in the high attack complexity (AC:H), which typically depends on heap state and timing. No authentication is required of the attacker (PR:N). Limiting factors for defenders: mandatory user interaction, the non-deterministic/high-complexity nature of UAF exploitation, and that only unpatched client builds below the fixed versions (e.g., Windows 11 24H2 < 10.0.26100.9711, Windows 10 1607/Server 2016 < 10.0.14393.9612) are affected.

This is a genuinely serious but NOT top-priority-today issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes a client-side use-after-free: no privileges are required (PR:N) and the attack is network-delivered (AV:N), but it carries BOTH high attack complexity (AC:H) and required user interaction (UI:R), meaning the victim must actively initiate an RDP connection to an attacker-controlled or malicious server and the attacker must win a non-deterministic memory-corruption condition. These two signals materially lower real-world likelihood versus a server-side, zero-click flaw. The non-CVSS signals agree: SSVC reports Exploitation=none and Automatable=no (consistent with a user-interaction-gated client bug that cannot be sprayed at scale), while Technical Impact=total matches the C:H/I:H/A:H code-execution outcome. There is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood could not be weighed. Net: a high-impact, wide-footprint (every supported Windows RDP client) memory-corruption RCE that should be patched on a normal-to-expedited cycle, but current evidence points to difficulty of exploitation and no observed in-the-wild activity rather than an emergency.

An attacker stands up a malicious or compromised RDP endpoint and lures a user (via phishing link, .rdp file, or redirected connection) into connecting with the Windows Remote Desktop Client. Malformed server responses trigger a use-after-free in the client, and by winning the associated heap race the attacker achieves code execution in the context of the connecting user. No public exploit code is identified at time of analysis, and high attack complexity (AC:H) plus required user interaction make reliable exploitation non-trivial.