Remote Desktop Client EUVD-2026-99858

Exploitation requires the victim to use the Windows Remote Desktop Client to connect to an attacker-controlled, malicious, or compromised RDP server - this is a client-side vulnerability, not an exposed-server flaw, so inbound RDP firewalling does not mitigate it. The UI:R metric confirms mandatory user interaction (the user must launch/accept the outbound connection, e.g. by opening a crafted .rdp file or clicking a link), and AC:H indicates the attacker must also win a race condition inherent to the use-after-free, both of which materially limit real-world exploitability. PR:N confirms no authentication to the victim system is needed. The limiting factors are therefore the required user action and the attacker's need to control the server endpoint the client reaches.

This is a client-side remote code execution flaw in the Windows Remote Desktop Client, and the signals point to a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) shows the key tensions: it is network-reachable and needs no privileges, but it carries high attack complexity (AC:H, consistent with winning a race to exploit the CWE-416 use-after-free) AND mandatory user interaction (UI:R) - the victim must actively initiate or accept a connection to an attacker-controlled RDP endpoint. CISA's SSVC framework reinforces lower urgency: Exploitation=none and Automatable=no, which aligns with a client-side bug that cannot be sprayed across the internet, even though Technical Impact=total matches the C:H/I:H/A:H full-compromise rating. There is no EPSS score, no KEV listing, and no evidence of public exploit code in the provided data, so there is no public exploit identified at time of analysis. The main caveat: this affects the RDP *client*, not a listening server, so the usual mental model of 'patch the exposed RDP server' is inverted - the exposure is users connecting outbound to malicious or compromised servers, which is a real but comparatively narrow attack surface.

An attacker stands up a malicious RDP server (or compromises/spoofs one a user trusts) and lures a victim into connecting to it, for example via a crafted .rdp file, a phishing link, or a malvertised 'remote support' endpoint. When the victim's Remote Desktop Client processes attacker-controlled server responses, it triggers the use-after-free, allowing arbitrary code execution in the context of the connecting user. No public proof-of-concept is identified in the available data, and the high attack complexity means reliable exploitation likely requires winning a memory race.