Windows RDP CVE-2026-50497

No special conditions - remote unauthenticated exploitation against a reachable RDP listener of affected Windows/Windows Server builds (CVSS AV:N/AC:L/PR:N/UI:N). The only real prerequisite is network reachability to the RDP service (typically TCP 3389). Exploitation is limited by anything that blocks pre-authentication access to the RDP stack: enforcing Network Level Authentication, fronting RDP with a VPN or RD Gateway, or firewalling port 3389 all prevent an unauthenticated attacker from reaching the flaw. Impact is further limited to information disclosure only (C:H/I:N/A:N) - no code execution, tampering, or denial of service - so a successful attack leaks memory rather than granting control.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy, network-reachable, unauthenticated trigger, which produces the 7.5 base score, but impact is limited strictly to confidentiality (C:H, no integrity or availability). Real-world exploitation signals are comparatively low and mutually consistent: EPSS is only 0.89% (55th percentile), there is no KEV listing, no public POC, and CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: partial. Nothing here conflicts - it is an easily reachable but disclosure-only bug that is not yet weaponized. The main aggravating factor is prevalence: RDP is exposed on an enormous number of Windows hosts and internet-facing RDP is a perennial target, so a memory-disclosure flaw is worth patching promptly even though it is not code execution. Net priority: important but not an emergency - prioritize internet-exposed and jump-host RDP endpoints first.

An attacker who can reach an exposed RDP listener sends a specially crafted RDP request that triggers the off-by-one overread, causing the service to return a slice of adjacent server memory in its response. Repeating the request could progressively harvest sensitive memory contents such as session data or credential fragments. No public exploit code is identified at time of analysis, and the low-complexity network vector means no user interaction or authentication is needed to attempt it.