EUVD-2026-44111
GHSA-cmg3-vm26-f974
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated overread of the RDP listener with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is disclosure-only, so C:H and I/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) lets a remote, unauthenticated attacker read out-of-bounds memory across a wide swath of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The root cause is an off-by-one error (CWE-193) that overreads adjacent memory, potentially leaking sensitive process data; CVSS is 7.5 with confidentiality-only impact and no code execution. There is no public exploit identified at time of analysis, and the low EPSS (0.89%) plus CISA SSVC exploitation status of 'none' indicate no observed exploitation yet.
Technical ContextAI
The flaw lives in the Remote Desktop Protocol stack that services connections to the Windows Terminal Services/RDP listener (typically TCP 3389). CWE-193 (off-by-one) means a length or index calculation is miscomputed by a single element, causing the RDP service to read one unit beyond an intended buffer boundary and return that adjacent memory content over the wire. Because the CVSS impact is C:H/I:N/A:N, the bug leaks memory rather than corrupting it, so the practical consequence is disclosure of process memory (which could contain sensitive fragments) rather than a crash or code execution. The CPE set spans microsoft:windows_10_* (1607, 1809, 21H2, 22H2), windows_11_* (24H2, 25H2, 26H1) and windows_server_2012/2012_r2, and per the tags and EUVD data also Server 2016/2019/2022/2025 including Server Core installations, indicating the vulnerable RDP code is shared broadly across the Windows codebase.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each affected build to at or above its fixed version (for example Windows 11 24H2 to 10.0.26100.8875, Server 2022 to 10.0.20348.5386, Server 2012 R2 to 6.3.9600.23291, Server 2025 to 10.0.26100.33158) as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50497. Until patching completes, reduce exposure by restricting RDP (TCP 3389) at the network edge so it is not reachable from the internet, placing RDP behind a VPN or Remote Desktop Gateway, and enforcing Network Level Authentication (NLA) so unauthenticated attackers cannot reach the vulnerable pre-auth code path - note that NLA requires clients supporting CredSSP and may break legacy thin clients. Where RDP is not required, disable Remote Desktop entirely, accepting the loss of remote interactive administration. Firewall/allowlist source IPs to known admin jump hosts to shrink the reachable attack surface.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today