The RDP Room That Was Never Cleared — Reconstructing CVE-2026-56190

1 Update, restart, and restrict ingress before judging the past

The remote-desktop credential prompt resembles a room's reception desk. Windows has already negotiated protocol choices and allocated connection state before that desk appears. CVE-2026-56190 sits in this preparation. The Microsoft vulnerability record classifies it as Windows RDP remote code execution with CWE-908 and CVSS 3.1 score 9.8. The attack condition is a reachable RDP service with NLA disabled; the attacker needs no account or local user action.

Network Level Authentication, usually implemented with CredSSP on Windows, validates credentials before a complete remote-desktop session is established. It changes how far an anonymous peer can move through connection setup, making it the most valuable ingress boundary while updates roll out. It leaves the affected component installed and cannot reconstruct when policy was disabled or a bypass existed. Repair, ingress hardening, and historical review therefore need independent evidence.

The 9.8 score, Microsoft's Important product severity, and its Less Likely exploitation assessment answer different questions. Network reachability, low attack complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact describe the technical consequence in the CVSS vector. Microsoft's labels record its product and exploitability judgments at publication. SOSEC's Critical label follows the 9.8 technical score while preserving Microsoft's wording here. Affected build and ingress decide remediation priority; local timeline and host evidence decide incident confidence.

The production default is direct: select the Vendor Fix currently listed for the product, release, and architecture in Microsoft's live July 2026 CVRF, or install an applicable supported successor cumulative update, then complete the required restart. NLA and strict ingress immediately reduce unauthenticated reachability. The update replaces the affected implementation. Historical review separately determines whether a reachable non-NLA window existed before activation.

Microsoft marks every mapped remediation as restart required. On Jul 27, 2026, the live map still names the Jul 14 security updates as the current fix entry. Windows 11 26H1 x64 and ARM64 now both map to KB5101649, OS build 28000.2525. Inventories that leave x64 on June KB5095051 / 28000.2269 carry an obsolete mapping.

1.1 Patch and NLA state create a four-cell response

• Updated, NLA required: proceed to normal runtime acceptance and verify boot, allowed route, denied route, and business function.
• Updated, NLA disabled: the CVE code repair is active; the ingress configuration still needs an owner and completion date.
• Unupdated, NLA required: immediate unauthenticated reachability is lower and the update remains required; any temporary NLA disablement changes priority.
• Unupdated, NLA disabled: enter the immediate-response queue, restrict sources, preserve relevant logs, then update, restart, and accept.

Exposure discovery works backward from the target. The active listener can use a port outside 3389. RD Gateway governs routes that actually traverse it. User networks, cloud security groups, secondary public addresses, load-balancer back ends, and emergency management segments can bypass the intended front door. External scans describe one vantage point at one time. Asset inventory, host listeners, Windows Firewall rule groups, upstream policy, and gateway configuration form the authoritative route map together.

When several scanners report the same CVE, retain each collection time and method, then reconcile on stable asset identity, product, architecture, full OS build, package state, and last boot. An agent that says “installed” while a network source still reaches an old service becomes a restart or asset-correlation task. Premature deduplication erases that useful disagreement.

Host evidence reads service configuration, active listening sockets, effective firewall rules, and policy result together. Network evidence tests the target address and gateway back end from each authorized vantage point. Join both sides on asset ID, destination, port, collection time, and vantage. That record can distinguish policy delivered but not effective, a stopped service behind continued upstream forwarding, one name resolving to several hosts, and a scan still reaching a retired address.

A legacy client that temporarily blocks NLA belongs behind a gateway or dedicated jump host with narrowed source and target. The exception records an owner, monitoring, recovery route, and automatic expiry. Port changes, rate limiting alone, and restarting the old build leave credential-first authentication and source restriction absent.

2 Pre-authentication setup hands ShareClass to the state machine

2.1 Six consecutive steps form the defect path

1. Pre-authentication RDP stage: with NLA disabled, an anonymous peer can enter connection initiation and basic settings exchange. The MS-RDPBCGR connection sequence places this work before licensing, capability exchange, and finalization.
2. Client settings enter connection code: WDWConnect processes Core, Security, Network, Cluster, Monitor, Message Channel, and Multitransport data families while building server-side connection state.
3. Object allocation: near its tail, WDWConnect calls WDWNewShareClass; the prior sample requests 0x11f8 bytes for ShareClass.
4. Prior initialization and publication: the old routine executes six stores and places the pointer at +0x80 in parent tagTSHARE_WD. Other code can now reach the object through the parent.
5. State-machine consumption: the caller proceeds into SM_Init and SM_Connect. Public material leaves the first stale private member and the complete member-to-consumer path undisclosed.
6. Microsoft's fixed path: the repaired sample calls the newly visible ShareClass::ShareClass before parent publication, moving systematic initialization ahead of consumer reachability.

This sequence joins three evidence classes. Microsoft supplies the unauthenticated network condition and RCE consequence. The open specification supplies the early protocol stages. Signed binaries and public symbols supply allocation, publication, and the state-machine handoff. The specific trigger field remains private implementation information, so no GCC data family receives that label here.

GCC here means the Generic Conference Control data that carries client and server settings during early RDP connection establishment. After X.224 negotiation, the client submits GCC Conference Create Request data inside MCS Connect-Initial. The Core, Security, Network, Cluster, Monitor, Message Channel, and Multitransport families processed by WDWConnect describe version and desktop properties, security capability, static virtual channels, session behavior, display layout, and later transport capability. They explain how wire input shapes connection state while leaving the first CVE trigger field unidentified.

The Open Specifications divide a complete connection into initiation, basic settings exchange, channel connection, security commencement, secure settings exchange, licensing, capability exchange, and finalization. This report uses that order only as timing evidence: the MCS/GCC data carrying client settings reaches server connection setup before a desktop logon and final capability confirmation. The specification does not map Windows private functions or fields. PDBs therefore supply function identity, pinned machine instructions supply writes and publication order, and the advisory supplies security consequence. Each claim stays with the strongest source that can support it.

The pointer store at parent +0x80 is the lifecycle boundary. The program writes no explicit flag named ready, yet code holding the parent can retrieve ShareClass from that point onward. The state machine immediately continues through initialization and connection work; cleanup, missing-capability, and negotiation-failure routes can also inspect connection state. Publication therefore says more about readiness than one successful ordinary login.

General C++ heap allocation guarantees suitably sized and aligned storage, not zero-filled contents. New pages in a development run can coincidentally look clean, while a long-running service reuses storage released by earlier work. Construction writes and publication order supply the relevant evidence. A single debugger snapshot filled with zeroes supplies only one execution's allocator history.

The protocol families also explain why an ordinary client test has limited coverage. Monitor layout, static virtual channels, cluster flags, and multitransport capability can change later writes and cleanup. When a client omits one capability, its ordinary branch-specific assignment can be absent as well. These branches define the consumer surface; the triggering combination remains undisclosed. The repair's value is that every reviewed route starts from the same initialized state, independent of later optional assignments.

Swipe horizontally on mobile to view the full lifecycle figure.

2.2 The initialization table keeps the residual unknown visible

This table is a controlled static measurement of the two pinned Server 2022 x64 samples. It describes observed machine-code write coverage. Microsoft's private type layout remains unavailable.

The report therefore carries two bounded conclusions. Microsoft declares the July update the Vendor Fix for CWE-908. SOSEC observes systematic pre-publication initialization in the fixed Server 2022 sample. The first stale member, complete private-type coverage, and concrete consumer path remain unknown.

The old routine's header work consists of one parent pointer and five 32-bit values. The fixed construction path recreates those established values before performing the remaining initialization shown in the table. The header proves the object-parent relationship and a limited set of early values; it cannot stand in for a valid initial state across the private class. The fixed branch preserves external object size, parent relationship, and later state-machine interface while concentrating the change in state established before consumer reachability.

The coverage table separates “which byte positions receive observed writes” from “what those positions mean in Microsoft's private C++ type.” Instruction width and interval union can reproduce the first question. Complete member layout, inheritance, and consumer reads are needed for the second. Residual positions may be alignment padding or members absent from public symbols; the current record cannot classify each one. Future private-type or consumer evidence should begin with those residuals. Semantic completeness must come from type and consumer evidence.

The repaired branch also changes maintainability: defaults converge in a construction path and publication follows. A future member that follows this design has a clear review point for zero and special defaults. The WIL feature gate integrates that implementation into Windows servicing. Production administrators accept the supported package, build, and restart; the internal feature number should never become an operational dependency.

3 Impact stops at Microsoft's finding of influenced memory writes and the RCE ceiling

3.1 CWE-908 appears here as an indeterminate object state

A general heap allocation supplies sufficiently sized, aligned storage whose bytes can retain data from an earlier object in the same process. Client capability combinations, connection volume, error paths, and cleanup timing then change later writes and consumption order. The old path makes a connection object reachable while its initial state remains incomplete.

Heap reuse creates uncertainty as well as exploitation constraints. Concurrent sessions, service threads, allocator behavior, address randomization, and unrelated component work all change the origin of a same-sized region. Public experiments do not establish how much allocation rhythm a remote peer controls or whether a required stale value can be placed reliably. Microsoft's Less Likely assessment is compatible with those constraints, although the advisory gives no complete rationale. Defenders can remove the accidental allocator state through supported servicing without waiting for a stable heap layout.

Microsoft's FAQ gives the consequence chain: specially crafted RDP traffic interacts with improperly initialized memory, memory corruption follows, the attacker can influence how memory is written, and further system compromise may result. Public evidence supports remote code execution as the consequence ceiling. It supplies no stable arbitrary-address/arbitrary-value primitive, first stale member, destination address, or reusable exploit packet.

“Influence how memory is written” is the narrowest public mechanism statement available. A stale value interpreted as a length, index, state, count, or indirect reference could change a later operation or its destination. The private consumer path is needed to determine which interpretation occurs. This report retains Microsoft's RCE ceiling and keeps control granularity, destination, and reliability in the unknown column.

Microsoft's product severity is Important, its exploitation assessment is Less Likely, and publication recorded no public disclosure or known exploitation. SOSEC's Critical site label follows the 9.8 technical score. Asset remediation stays urgent; incident confidence comes from the local exposure window and host evidence.

Publication status is time-bound as well. Microsoft recorded no public disclosure or known exploitation at release, and the Jul 27 official review still exposes the remediation through the current map; either field can change later. The ticket retains query date and source so a revision can adjust hunting depth and risk communication. “No known exploitation” describes Microsoft's public record at that time. It cannot replace the organization's gateway, host, and identity review, and it does not reduce the update requirement for an affected asset. This keeps patch priority stable while the investigation scope follows new evidence.

3.2 Historical review separates susceptibility, exposure, attempt, and compromise

• Susceptible: product and architecture fall within Microsoft's range and the running build is below its floor, or installation has completed without a later restart.
• Exposed: a reachable RDP route existed during susceptibility and effective NLA was disabled, including direct access, gateway back-end bypass, secondary addresses, and temporary firewall rules.
• Plausible attempt: the exposure window contains anomalous short-connection clusters, negotiation failures, Remote Desktop Services faults, WER, or relevant dumps correlated by source and time.
• Compromise: host or identity evidence shows unauthorized execution, child processes, credential access, persistence, lateral activity, or changed business objects.

At least five evidence families participate: product/architecture/build/KB/boot; RDP/NLA/ingress history; connection and RD Gateway identity; service events/WER/dumps; and administrative, scanner, and maintenance context. Join them on stable asset identity and time while retaining original time zone, collection scope, and retention.

Build the exposure interval from both ends. Its start is the later of affected code entering service or a reachable route operating with NLA disabled. Its end is the earliest of fixed code completing restart, the route becoming restricted, or the asset leaving service. Package installation before restart leaves the interval open. A present-day policy screenshot cannot describe a weekend troubleshooting exception. Every policy change, gateway route adjustment, temporary firewall grant, and image restoration belongs on the same timeline.

Network sources also need resolvable identity. NAT, VPN concentrators, RD Gateway, DHCP, cloud front ends, and elastic addresses can place many people behind one IP or move one address between devices. Preserve gateway user, device certificate, authentication event, lease, cloud instance identity, and known clock error alongside flows. An IP is an observation; attribution comes from the joined record.

A network byte signature currently lacks complete detection coverage. Early RDP negotiation contains legitimate variation and the public record contains no trigger packet. A more useful alert combines a below-floor host, disabled NLA, a burst of short connections, near-time service or WER failure, and an unexpected restart or child process. The temporal cluster with host context enters preservation.

Negative results need explicit coverage. “No anomalous RDP observed” names the ingress, target, source set, time range, collection method, and retention. Seven days of flow data cannot clear a six-month exposure interval, and a healthy dump captured after restart cannot recreate fault-time memory. Missing intervals stay unobservable with a next collection action. Log absence does not lower the risk derived from known susceptible and exposed conditions.

When a suspicious fault appears, preserve native event channels, WER directories, service dumps, EDR timeline, gateway audit, firewall records, and effective policy before route restriction, update, and restart. Dumps can contain session and memory material and require high-sensitivity handling. Remediation and forensics can proceed together. Successful servicing closes the future vulnerability window; historical uncertainty stays in the incident finding.

A dump also needs context. Retain exception code, faulting thread, symbolized stack, service restart, neighboring objects, and source time. Drivers, exhaustion, third-party extensions, and unrelated defects can crash remote-desktop components. Similar faults on comparable hosts at correlated times strengthen the association; a module name directs the investigation to a component and carries no incident verdict by itself.

4 Microsoft's remediation map on Jul 27, 2026

4.1 Product, architecture, build, and KB travel together

The table consolidates 27 Known Affected product entries in Microsoft's live CVRF into 11 operational rows. The fixed build is the historical first-fixed floor. On the review date, the named KB remains the current CVRF Vendor Fix. A later applicable supported cumulative update can carry the repair forward.

A CVRF product entry establishes vulnerability and remediation mapping. Edition, servicing channel, ESU, and licensing determine package entitlement. Microsoft's third year of Server 2012 / 2012 R2 ESU ends Oct 13, 2026. Legacy systems without valid entitlement need migration, durable isolation, or retirement. Windows 10 assets likewise require edition-specific LTSC or ESU confirmation.

The 26H1 change shows why an asset record needs source time and full build. The Jul 17 pinned research material carried a different x64 entry; by Jul 27, the live CVRF mapped x64 and ARM64 to the same July update. Production follows the latest official record while the older capture remains versioned evidence of what was visible then. A KB name stored without product, architecture, build, and query time cannot be corrected reliably against individual assets.

4.2 The deployment record proves running code changed

Each asset retains product family, release, edition, architecture, full OS build, applicable KB or successor, installation completion, and last boot. Windows Update, CBS, or management-platform package state; the product-specific build floor; and a successful boot after installation jointly establish activation. One component version remains supporting evidence for a research sample.

“Minimum fixed build” and “current Vendor Fix” serve different jobs. The floor identifies when a historical timeline first crossed the repaired boundary. The Vendor Fix is the official installation entry on the review date. Later cumulative updates raise the build and carry earlier repairs forward, so acceptance admits an applicable supported successor for the same product, architecture, and servicing channel. A numerically higher package for a different product or architecture establishes nothing for the host.

Individual components also keep their own servicing revisions. The July Server 2022 operating-system build is 20348.5386 while the pinned rdpserverbase.dll file version is 20348.5382; that difference is normal for component-based servicing. Fleet records use full OS build, applicable package, and restart as primary proof. DLL hash and symbols identify a specific research artifact.

Session hosts stop new logons and drain. Cluster nodes leave distribution, update, restart, and return one at a time. Golden images, autoscaling templates, offline VHDs, disaster-recovery copies, and powered-off machines receive stable asset identities. Repair the source image, boot an acceptance instance, and then replace the deployment source. An unknown restored image first enters update-only quarantine.

The first rollout wave uses hosts with out-of-band recovery, representative business traffic, and controlled ingress. Before expanding, it checks installation, boot, effective NLA, allowed and denied routes, required redirection, and the observation window. A predefined fault threshold pauses the next wave. Stop conditions, recovery owner, and business fallback are agreed before installation so that an outage cannot renegotiate what counts as evidence.

Before deployment, confirm out-of-band or cloud-console access, configuration backups, failure criteria, and a recovery owner. An installation failure leaves ingress restricted and reopens scheduling. Every rollback record carries a risk-restoration action so that an old build cannot persist after the maintenance ticket closes.

5 Research validation and fleet acceptance use separate matrices

5.1 The research matrix validates this static reconstruction

This matrix serves report reproduction. Production acceptance stays at the supported package and host boundary: business servers receive no breakpoints, dirty-allocation experiments, or internal feature-gate manipulation. The complete chain of custody and falsification steps appear in the Chapter 7 methods appendix.

A research-matrix pass grants only the conclusion supported by its inputs. Agreement among signature, manifest, PE structure, and PDB key establishes artifact identity. Agreement among calls and write order establishes the reviewed branch's object lifecycle. Those results leave dynamic triggering, other architectures, and the private-field consumer untested. Each finding retains artifact hashes, tool versions, measurement command or script, reviewed edges, and uncovered paths.

Negative controls keep an attractive binary diff from becoming attribution by appearance. After symbol names are removed, the candidate still needs the same allocator, caller, parent publication, and state-machine relationship. An unrelated initialization change from the same cumulative update should lose that relationship. A build or architecture mismatch, delta applied to the wrong baseline, or conflicting PDB key stops the process before instruction interpretation.

A future controlled dynamic corroboration should use paired inputs produced by ordinary compatible clients: a data family present and absent, legal boundary values and invalid counts, early rejection and completed session, and NLA enabled and disabled. Record the protocol phase, service result, events, object construction, and cleanup route reached by each case. Positive controls first show that the fixed system still accepts valid sessions; negative controls show invalid sessions fail according to protocol. Only then should the study observe whether input choices change a known object path. This design measures implementation routes and regression behavior. It generates no exploit packet and never converts crash counts into exploitability.

5.2 The fleet matrix accepts supported servicing and business routes

Every dashboard color must open to raw values and collection time. One successful login covers the allowed route. One local port test covers the local vantage point. The acceptance record keeps allowed, denied, NLA, gateway-bypass, and boot evidence together.

A representative host begins with identity: management reports completed installation, its operating-system build crosses the branch floor, and last boot follows installation. The operator then reads effective NLA and policy source on the host, opens a business session from the approved jump host, confirms blocking from a denied source, and probes the gateway back end for bypass. Finally, the real client exercises required clipboard, drive, printer, virtual-channel, or multi-monitor behavior while RDS, WER, and system events are observed. Each step answers a separate question and carries its own signature.

Scanner disagreement closes in the fleet matrix as well. Agent, network scan, cloud-image check, and configuration records retain their own collection times; current build, last boot, listener route, and stable asset identity reconcile them. A host waiting for restart stays “pending activation.” An instance recreated from an old image returns to “unremediated.” An ingress exception past expiry escalates to its operational and risk owners.

One change day can produce four different actions. In the morning, the agent records installation while boot time still predates it, so platform operations schedule restart. A network scan then discovers a listener outside 3389, so network operations add that path to the route map. Effective policy confirms NLA and narrows the exposure condition. A successful direct test to the gateway back end keeps the ingress task open. Only after restart crosses the build floor, the approved route succeeds, and both the denied source and back-end bypass fail does the host enter health observation. The records close code, identity, and route fields independently.

Ownership follows the evidence boundary. Platform operations signs package, build, and boot; identity signs effective NLA; network operations signs sources and bypasses; the application owner signs representative function; and the SOC signs the observation window and historical finding. A failure reopens its acceptance row and dependent conclusions. The final ticket keeps raw values, collection time, owner, exception expiry, and recovery entry so a later image restoration or policy drift can rerun the same review.

6 Rollback, exceptions, and historical findings determine closure

6.1 Upgrade failure and rollback have explicit security states

Download complete, installation registered, restart pending, and fixed code running are four states. When the first two succeed and restart remains pending, the service can retain the earlier component in memory; platform inventory stays “pending activation.” A package failure, component-servicing fault, or below-floor build keeps ingress restricted and reopens update scheduling.

Compatibility diagnosis retains client version, selected security protocol, virtual channels, gateway route, events, and service traces. Rollback restores the affected implementation. Approval therefore activates mandatory NLA, minimum sources, monitoring, an owner, automatic expiry, and a supported-repair recovery plan. Recovery admission uses the fleet matrix in Chapter 5 and requires more than one temporary successful login.

Rollback also needs containment against automated propagation. Autoscaling groups stop using the old template, disaster-recovery exercises exclude unremediated copies, and configuration management keeps rolled-back nodes out of the ordinary compliance-green state. A reproduction environment retains the affected client and route while production carries only necessary service. After compatibility repair passes, update the source image first and retire each exception deliberately.

Support lifecycle also enters closure. Server 2012 / 2012 R2 ESU eligibility ends in October 2026, while Windows 10 branch eligibility varies by edition and program. Assets without a supported code update close through migration, durable isolation, or service retirement, with ingress restriction protecting the transition.

6.2 Vulnerability and incident findings receive separate signatures

The vulnerability finding records when the host installed its applicable update, completed restart, reached its running build, enforced NLA, and restricted sources. The incident finding records the reviewed pre-patch interval, data sources, anomalies, resolved explanations, unobservable time, and remaining response. Both share asset identity and timeline while answering different questions: future repair and past activity.

A useful incident finding can read: “The asset ran below its fixed floor from A to B; NLA was disabled from C to D; source set E was reachable during the intersection; connection and host telemetry cover F; an earlier interval remains unobservable because retention begins at G.” That record exposes condition, time, result, and gap. Unauthorized child processes, credential access, persistence, or lateral movement immediately promote the case to compromise response and widen isolation and hunting.

Continuous control reuses the same ledger. Snapshot restore, image scale-out, update rollback, NLA drift, or broader ingress reopens the conclusion. Gateway identity, firewall flow, RDP and service events, WER, update, boot, and EDR context use joinable clocks. Claimed historical visibility cannot exceed the shortest critical-source retention.

Reopening conditions belong close to the change source. Image pipelines check the minimum build, configuration systems watch effective NLA, network-policy review compares approved sources, and inventory detects boot-time regression and new instances. The alert carries the prior finding ID and changed state so a fresh ticket does not discard history. The owner reruns the affected acceptance row; unrelated fields can reuse evidence that remains current.

CVE-2026-56190 leaves a plain engineering discipline: raw storage allocation, object initialization, publication, and consumer use are separate boundaries. Production repair depends on Microsoft-supported servicing. Research findings depend on reproducible artifacts. Incident findings depend on local evidence. Closure becomes stable when all three are complete.

7 Methods appendix: artifact custody and falsification

7.1 One chain carries MSU identity to function identity

The pinned comparison uses Server 2022 x64 KB5094128 and KB5099540 from Microsoft Update Catalog. The prior MSU SHA-256 is 94949f1780466262096df4fe7f4343abc010caa71d378dd08ac28e9bc70238b; the fixed MSU is 16b341f8a815acf7f94695f3afc1bccbd70f3ad934ddf7d7c224dd015fab5438. Nested CABs, component manifests, and PSF/PA30 deltas locate and reconstruct the target component.

MSU is the standalone Windows update container. A component inside can be represented as a PSF/PA30 delta that requires its expected baseline. PE is the Windows executable-image format. Its CodeView record connects an image to the corresponding PDB, the Microsoft symbol file that restores function identity and partial type relationships. These terms stay in the methods appendix and answer artifact identity. The RDP object lifecycle comes from the later call and write ordering.

A PA30 delta requires its expected baseline to produce a complete PE. The reconstructed rdpserverbase.dll pair agrees across file version, size, sections and directories, CodeView, Microsoft Authenticode, and package manifest. The prior file is 2,053,656 bytes and the fixed file 2,053,616 bytes; their hashes appear in the early response block.

A wrong baseline can still produce a file that a disassembler opens. Admission requires agreement among section sizes, imports, relocations, exception directory, image size, file version, signature chain, component manifest, and CodeView. Any conflict makes later addresses, function pairing, and coverage arithmetic meaningless.

The prior public-PDB key is BE0DCB802DC98FFC3E7F0B0ED21B561C1; the fixed key is 510DA22952F32495CE9418F9B929F3131. PDBs supply function identity and partial type relationships. Machine instructions supply allocation size, write width, offset, and order. Decompiler-generated local names stay outside product facts.

Ghidra 12.1.2 identified 4,360 functions in the old file and 4,369 in the fixed file; structural matching produced 2,823 unique exact pairs and 867 high-similarity changed candidates. Candidate count describes the cumulative-update search space. WDWNewShareClass enters the causal chain because public symbol, caller, allocation, parent publication, and new constructor converge with Microsoft's CWE-908 description.

The fixed image also places the WIL path near constructor address 0x180133108, with public symbols associating it with Feature_2152440120. That coordinate exists to reproduce the July Server 2022 x64 servicing implementation. The article treats construction before publication as an observation of shipped code. The feature number participates in neither asset selection nor mitigation and acceptance. Official servicing and the running build remain the production control plane.

Function addresses reproduce one pinned image and make poor cross-month detection signatures. Cumulative updates move layout, merge blocks, and change compiler scheduling. The durable review unit is relational: the same connection caller requests the same-sized object, the old path exposes it after limited setup, and the fixed path constructs it before exposure. When addresses move and these relationships persist, the mechanism remains reproducible.

Static comparison also meets compiler-optimization boundaries. Inlining, tail calls, constant propagation, and alias stores can express one semantic write through different instructions, so coverage deduplicates actual address intervals and reviews callers and exceptional edges. A future dynamic validation should begin with paired valid and invalid connections and record the protocol phase and object accesses reached. One crash, one breakpoint hit, or one allocator pattern cannot independently promote a field or packet to trigger status.

7.2 Five conditions can overturn or narrow the reconstruction

1. A mismatch in package hash, product, or architecture stops comparison and requires fresh artifacts.
2. A conflict among PE signature, structure, CodeView, and PDB key invalidates function identity and addresses.
3. After symbol names are removed, loss of the same allocation, caller, parent publication, and consumer relationship invalidates CVE attribution.
4. An unreviewed alternate publication route, exception edge, or alias store in the fixed image limits “construction before publication” to the reviewed path.
5. New public field or consumer type evidence triggers reclassification of the 23 residual positions and first stale member; the current publication keeps them unknown.

The research used local static processing only. It exposed no RDP listener, generated no exploit traffic, and repeated no per-architecture binary diff. Microsoft's product range supports fleet remediation. Exact object size, addresses, and write plan stay bound to the Server 2022 x64 samples. Dynamic trigger field, first private consumer, write destination, control granularity, and in-the-wild exploitation remain public evidence gaps.

A reproducibility record retains the official entry, query time, package and component hashes, signature result, CodeView/PDB key, tool version, function address, call relationship, write intervals, and falsification outcome. Commands and per-artifact receipts belong in the stable ledger; the article keeps results that change mechanism or decision. Review starts from package identity, and any intermediate conflict stops interpretation. Once identities agree, the reviewer follows the caller through publication on the pinned branch.

The search and experiment gap review follows those boundaries. Official advisory and live CVRF, applicable update pages and Catalog, Server 2012 ESU guidance, RDP Open Specifications, signed packages, public symbols, and the local static comparison close product scope, network prerequisite, artifact identity, object lifecycle, repair ordering, and operational response. Public evidence still leaves five questions open: private-member semantics, actual trigger data, dynamic control, implementation equivalence on other architectures, and historical exploitation. Further prose belongs in the report only when it changes one of those boundaries, the repair decision, or an acceptance action. The same boundary gives later revision reviews a defined starting point.