Remote Desktop Client EUVD-2026-99849

Exploitation requires the victim to run the Windows Remote Desktop Client (mstsc) and actively initiate or accept an RDP connection to an attacker-controlled, compromised, or spoofed RDP server - this user interaction (UI:R) is a hard prerequisite, so there is no server-side exploitation of listening hosts and no path against a client that never connects out. The High attack complexity (AC:H) indicates the attacker must satisfy additional conditions beyond their control, consistent with winning a use-after-free timing/memory-state race during the session rather than a deterministic single-shot trigger. No authentication to the victim is required (PR:N, unauthenticated), and impact does not cross a trust boundary to other systems (S:U). Limiting factors for defenders: mandatory user-initiated outbound RDP to a hostile endpoint, high exploit complexity, and CISA SSVC 'Automatable: no', all of which constrain scalable or opportunistic abuse; environments that restrict outbound RDP to trusted hosts materially reduce exposure.

This is a genuine high-severity memory-corruption flaw (CWE-416 use-after-free) in the Microsoft Windows Remote Desktop Client, but the signals converge on moderate rather than urgent real-world risk. The CVSS 3.1 base vector (AV:N/AC:H/PR:N/UI:R) and the 7.5 score reflect a network, unauthenticated path to full compromise (C:H/I:H/A:H) that is tempered by High attack complexity and required user interaction. Despite 'network' attack vector, this is fundamentally a CLIENT-SIDE vulnerability: an unauthorized attacker cannot reach arbitrary victims - the victim's RDP client must connect to an attacker-controlled or compromised RDP server, so 'over a network' does not mean server-side remote exploitation of exposed hosts. CISA SSVC strongly corroborates lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited), while Technical Impact=total (consistent with code execution). No CISA KEV listing and no POC were provided, so there is no public exploit identified at time of analysis. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. Net: a real, patch-worthy priority for environments where users connect to untrusted RDP endpoints, but not a drop-everything mass-exploitation threat - the AC:H + UI:R + client-initiated nature and 'Automatable: no' all limit scalable abuse.

An attacker stands up a malicious RDP server (or compromises/spoofs a legitimate one) and lures a user into connecting with the Windows Remote Desktop Client, for example via a crafted .rdp file or a hijacked connection target. During the session the malicious server sends crafted responses that trigger the use-after-free in the client, winning a race or memory-state condition (reflecting AC:H) to execute arbitrary code on the victim workstation. No public exploit code is identified at time of analysis, and the required user interaction plus high complexity make reliable exploitation non-trivial.