Remote Desktop Client EUVD-2026-99851

Client-side exploitation: a user running the Windows Remote Desktop Client must be induced to connect to an attacker-controlled or compromised RDP server (consistent with UI:R and 'execute code over a network'); the malicious server then supplies crafted data that triggers the use-after-free. LIMITING FACTORS: (1) required user interaction - the victim must initiate/accept the vulnerable connection (e.g., open a crafted .rdp file or link), so there is no unprompted server-side attack path; (2) high attack complexity (AC:H) - the UAF depends on winning a race or meeting specific heap/timing conditions, making exploitation non-deterministic and non-automatable (SSVC Automatable: no); (3) the target must run an unpatched client build below the fixed version for its Windows edition. No prior authentication to the client is needed (PR:N).

Signals point to a serious-but-not-emergency client-side flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes an unauthenticated network-reachable use-after-free (CWE-416) with full confidentiality/integrity/availability impact, but two metrics temper real-world risk: AC:H (the UAF requires winning a race or meeting specific memory conditions, not deterministic) and UI:R (a user must actively initiate the vulnerable client connection). CISA's SSVC framework corroborates lower urgency - Exploitation: none (no observed exploitation), Automatable: no (cannot be reliably mass-exploited, consistent with AC:H and the client-side UI:R requirement) - while Technical Impact: total aligns with the C:H/I:H/A:H code-execution outcome. KEV status is NO (not CISA-listed), so there is no confirmed active exploitation. EPSS is NOT provided in the input, so exploitation probability cannot be quantified here. No POC/exploit code is referenced, so status is 'no public exploit identified at time of analysis.' Net: this is a genuine code-execution bug in a ubiquitously deployed Windows component and should be patched promptly, but the combination of high attack complexity, required user interaction, no automatability, and no observed exploitation makes it a standard patch-cycle priority rather than an emergency - closer to a high-CVSS/moderate-real-risk issue absent new exploitation evidence. Note: the 'Denial Of Service' tag conflicts with the description, which explicitly states code execution; verify scope with Microsoft.

An attacker stands up a malicious or compromised RDP server and lures a victim into connecting to it with the Windows Remote Desktop Client (e.g., via a crafted .rdp file, link, or a hijacked legitimate host). The malicious server returns crafted responses that trigger the use-after-free in the client, and after winning the required race/memory condition (AC:H), the attacker executes code in the victim's client context. No public exploit code is identified at time of analysis, and user interaction is required to establish the connection.