Windows RDP CVE-2026-50445

Exploitation requires network reachability to an enabled Windows Remote Desktop service listening on port 3389; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed to trigger the over-read against a listening RDP endpoint. The practical limiting factor is exposure of the RDP service itself: hosts where RDP is disabled, firewalled to trusted management subnets, or fronted by a Remote Desktop Gateway/VPN with enforced Network Level Authentication remove or sharply reduce the reachable pre-authentication attack surface. Impact is bounded to information disclosure (C:H, I:N, A:N) - a buffer over-read returns adjacent memory rather than enabling code execution or denial of service - and the leaked data is partial and non-deterministic (SSVC Technical Impact: partial, Automatable: no), so it is more useful as an intelligence-gathering or ASLR-bypass primitive than a standalone compromise.

Signals are consistent and point to a real-but-moderate priority. CVSS 3.1 rates it 7.5 (High) driven entirely by remote, unauthenticated, low-complexity access (AV:N/AC:L/PR:N/UI:N) against confidentiality only. However, corroborating exploitation signals are all low: CISA SSVC lists Exploitation=none, Automatable=no, Technical Impact=partial, and EPSS is 0.67% (48th percentile) - below the threshold for imminent mass exploitation. There is no CISA KEV listing and no public exploit identified. The main tension is that a network-facing, no-auth information leak in a service as widely exposed as RDP is attractive to attackers, yet an over-read typically yields partial, non-deterministic memory rather than a reliable primitive, which aligns with SSVC 'partial' technical impact and 'not automatable.' Net: patch on a prompt cadence, prioritizing internet-exposed or DMZ RDP hosts, but this is not a drop-everything emergency absent evidence of active exploitation.

An attacker who can reach an exposed RDP listener (TCP/UDP 3389) on an unpatched Windows host sends crafted RDP protocol data that triggers the parser to read past a buffer boundary, and the server returns adjacent memory contents in its response. Repeating the request lets the attacker harvest fragments of process memory that may contain addresses defeating ASLR or sensitive session data. No public exploit is identified at time of analysis, and given AV:N/AC:L the trigger is low-complexity, though the over-read yields partial, non-deterministic data.