EUVD-2026-44150
GHSA-34jr-g339-3423
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered RDP attack with no attacker authentication needed (PR:N), but user must initiate or maintain an RDP session (UI:R); read-only memory leak yields C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in the Windows Remote Desktop Protocol (RDP) stack enables unauthenticated network attackers to disclose high-confidentiality memory contents from affected Windows systems, contingent on user interaction during an RDP session. The flaw (CWE-125) spans Windows 10 builds 1607 through 22H2, Windows 11 24H2 through 26H1, and Windows Server 2012 through 2025. No active exploitation is confirmed by CISA KEV, SSVC rates it non-automatable with partial technical impact, and EPSS sits at 0.67% (48th percentile), indicating moderate-to-low near-term exploitation probability despite the high confidentiality impact in the CVSS score.
Technical ContextAI
Windows Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol operating primarily over TCP/UDP port 3389, enabling remote graphical desktop sessions. CWE-125 (Out-of-Bounds Read) identifies the root cause class: the RDP implementation reads beyond the bounds of an allocated memory buffer when processing network-supplied data structures, exposing adjacent memory to the network peer. This class of flaw typically results from missing or insufficient length validation when parsing variable-length RDP PDUs or channel data. CPE strings confirm the vulnerable component is the Microsoft Windows RDP implementation across a wide build range, from Windows Server 2012 (kernel 6.2.9200.x) through Windows 11 26H1 (10.0.28000.x) and Windows Server 2025 (10.0.26100.x), encompassing both full and Server Core installations.
RemediationAI
Apply vendor-released patches from Microsoft targeting the following minimum fixed builds: Windows Server 2012 and Server Core to 6.2.9200.26226 or later; Windows 10 1607 and Windows Server 2016 and Server Core to 10.0.14393.9339 or later; Windows 10 1809, Windows Server 2019, and Server Core to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Windows Server 2022 to 10.0.20348.5386 or later; Windows Server 2025 and Server Core to 10.0.26100.33158 or later. Full patch details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126. Where patching cannot be applied immediately, restrict inbound RDP access (TCP/UDP 3389) to trusted network segments via host-based or perimeter firewall rules - this reduces the network attack surface but does not eliminate the vulnerability if RDP exposure is required. Enforcing Network Level Authentication (NLA) adds a pre-authentication step but, given PR:N in the CVSS vector, should not be assumed to fully mitigate the flaw; treat NLA as a defense-in-depth measure only.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today