EUVD-2026-43928
GHSA-559m-66h5-5q8j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
RDP is network-reachable with no attacker auth; victim must initiate connection (UI:R); uninitialized memory may expose high-value data (C:H); no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Windows Remote Desktop Protocol (RDP) exposes sensitive memory contents to network-adjacent attackers due to use of an uninitialized resource (CWE-908), resulting in high-confidentiality information disclosure. The flaw affects a broad swath of supported Windows client and server releases - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025 - and requires victim user interaction (UI:R per CVSS) to trigger, limiting automated mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation as 'none' with non-automatable technical impact, suggesting this is a real but not imminently weaponized risk.
Technical ContextAI
The vulnerability resides in the Microsoft Windows RDP implementation and is classified as CWE-908 (Use of Uninitialized Resource). This class of flaw arises when memory regions are allocated but not zeroed or otherwise initialized before data is read from them; an attacker who can observe the protocol output may recover fragments of process memory, including credentials, session tokens, or other sensitive data. CPE data confirms the affected component spans both client (Windows 10 and 11) and server (Windows Server 2012 through 2025) editions of Windows, implicating the RDP stack shared across these builds. The CVSS vector AV:N indicates the vulnerable code path is reachable over the network, consistent with RDP's default port 3389 exposure.
RemediationAI
Apply the vendor-released patches distributed through Microsoft's standard update channels; the fix versions confirmed by EUVD are build-specific and listed per platform in the affected products section above. Organizations should prioritize patching Windows Server 2016, 2019, 2022, and 2025 hosts that expose RDP externally or to untrusted segments, as these represent the highest-value disclosure targets. For systems that cannot be patched immediately, restrict RDP (TCP 3389) to authorized subnets using host-based Windows Firewall rules or network ACLs, reducing the attacker's ability to establish the required network channel; this does not eliminate risk but removes opportunistic access. Deploying Network Level Authentication (NLA) forces credential exchange before the RDP session stack is fully engaged, which may reduce the attack surface for this specific uninitialized-memory path - however, since the exact trigger is not fully documented publicly, NLA should be treated as a defense-in-depth measure rather than a definitive workaround. Windows Server 2012 and 2012 R2 are in extended support phases; organizations running these versions should apply the patches and assess migration timelines. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50376 is the authoritative remediation reference.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today