Windows RDP CVE-2026-42908

Exploitation requires only network reachability to the RDP listener (typically TCP/3389) on a vulnerable Windows host with Remote Desktop enabled; per CVSS PR:N/UI:N no credentials and no user interaction are needed, and AC:L indicates no special timing or environmental conditions. Limiting factors are that RDP must be enabled and reachable from the attacker (hosts with RDP disabled, firewalled off, or fronted by a Remote Desktop Gateway requiring pre-authentication are not directly exposed), and the primitive is read-only (C:H, I:N, A:N) so it leaks data but does not by itself give code execution, write, or denial-of-service capability.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a fully remote, low-complexity, unauthenticated read primitive with high confidentiality impact and no integrity or availability effect - a profile that historically maps to high real-world interest because RDP is broadly exposed on the public internet. However, EPSS data was not provided in the input, the CVE is not in CISA KEV, and no POC has been observed, so present-day exploitation likelihood cannot be quantitatively measured from the data given. The 'Buffer Overflow' tag in the input is inconsistent with CWE-125 (an out-of-bounds read, not a write/overflow); treat this as a tagging artifact rather than evidence of code execution potential. Practical risk should be considered elevated wherever RDP is internet-exposed, but absent KEV/POC signals this should be prioritized below any actively exploited RDP RCE issue.

An attacker reachable on the network to a vulnerable Windows host with RDP listening sends crafted RDP protocol messages during connection setup that trigger the out-of-bounds read, and observes leaked process memory returned in protocol responses or error data. Repeated connections can be used to harvest fragments such as session tokens, kernel pointers useful for ASLR bypass, or other secrets resident in the RDP service. No POC has been identified at time of analysis.