What is the CVSS score of CVE-2026-42908?

CVE-2026-42908 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Windows RDP are affected by CVE-2026-42908?

Microsoft Windows RDP deployments face unauthorized data access risk through a network-based memory exposure flaw that bypasses authentication entirely.. A patch is available.

How to fix or mitigate CVE-2026-42908?

Within 24 hours: Audit all Windows systems with RDP enabled; identify and document systems exposing RDP to untrusted networks; implement firewall rules restricting RDP access to authorized administrative networks and VPN gateways only. Within 7 days: Enable detailed RDP event logging (Event IDs 4625, 4624); deploy endpoint detection and response (EDR) monitoring for memory access anomalies; enforce Network Layer Authentication (NLA) on all RDP services; disable RDP on non-critical systems. Within 30 days: Establish continuous monitoring of Microsoft Security Response Center advisories for patch availability; evaluate and deploy RDP Restricted Admin mode; plan migration to cloud-based remote access solutions (Azure Bastion, Windows Virtual Desktop) as permanent architectural mitigation.

Windows RDP CVE-2026-42908

EUVD-2026-35597 HIGH

Out-of-bounds Read (CWE-125)

2026-06-09 secure@microsoft.com

GHSA-hv2r-hmcx-57g9

Buffer Overflow Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows App Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:41 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.5

DescriptionCVE.org

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) allows unauthenticated remote attackers to read out-of-bounds memory contents over the network, potentially leaking sensitive data from the RDP service process. The vulnerability requires no authentication or user interaction and is rated CVSS 7.5 with high confidentiality impact only. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is an out-of-bounds read (CWE-125) in the Windows implementation of the Remote Desktop Protocol, the proprietary Microsoft protocol (typically TCP/3389) used for remote graphical session access. CWE-125 conditions arise when input-derived offsets or length fields are used to index into a buffer without sufficient bounds validation, causing the parser to read adjacent process memory. In an RDP context this typically manifests during early protocol handshake or PDU/virtual channel parsing in the RDP service handling untrusted client-supplied messages, with leaked memory returned to the attacker via protocol responses or error paths.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42908 for every affected Windows client and Windows Server build in the environment as identified on that page. Where immediate patching is not feasible, restrict TCP/3389 (and UDP/3389) at perimeter and host firewalls so RDP is not reachable from the internet, place RDP behind a Remote Desktop Gateway or VPN that performs pre-authentication, and require Network Level Authentication (NLA) on RD Session Hosts so that protocol parsing only occurs after CredSSP authentication - these controls reduce, but do not eliminate, exposure to an internal attacker and may break legacy or kiosk-style RDP clients that cannot perform NLA.