Remote Desktop Services EUVD-2026-99853

Requires that the Remote Desktop Services / RDP component be present and reachable (default on Windows Server deployments exposing the RDS role, and on any host with Remote Desktop enabled). Two concrete factors LIMIT exploitation: (1) UI:R - the victim must take an action such as initiating or accepting a Remote Desktop connection to the attacker-controlled endpoint; exploitation is not fully drive-by. (2) AC:H - the attacker must satisfy a race or heap-grooming condition inherent to the use-after-free, so success is not reliable on first attempt. No prior authentication is needed (PR:N). Risk is concentrated on hosts with RDS/RDP exposed to untrusted networks or where users can be induced to connect outbound to malicious RDP services; hosts without the Remote Desktop role enabled are not exposed.

This is a legitimate but moderate-urgency vulnerability rather than a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes network-reachable, unauthenticated (PR:N) code execution with total CIA impact, but two metrics materially dampen real-world risk: high attack complexity (AC:H) and required user interaction (UI:R), meaning exploitation is neither trivial nor automatable. This aligns with and is reinforced by the CISA SSVC assessment: Exploitation=none, Automatable=no, Technical Impact=total - i.e. severe impact IF exploited, but no observed exploitation and no path to scaled, automated attacks. There is no CISA KEV listing and no POC was provided, so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are mutually consistent (high impact, low likelihood/complexity) rather than conflicting. Note a minor metadata tension worth flagging to teams: the input Tags include 'Denial Of Service' while the description and impact metrics describe remote code execution via use-after-free (CWE-416); the memory-corruption primitive can plausibly cause both outcomes, but this should not be triaged as a mere availability bug. Overall: patch on a normal prioritized cadence (a vendor patch is available), prioritizing internet-exposed or gateway RDS hosts, but it does not currently warrant emergency out-of-band response.

An attacker lures or coerces a target into initiating a Remote Desktop connection to an attacker-controlled or compromised RDS endpoint, where a specially crafted response triggers the use-after-free condition. Winning the race/condition required by the high attack complexity, the attacker corrupts memory to achieve arbitrary code execution in the context of the vulnerable service. No public exploit code was identified at time of analysis, and successful exploitation hinges on both user interaction and non-trivial timing.