EUVD-2026-44150
GHSA-34jr-g339-3423
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered RDP attack with no attacker authentication needed (PR:N), but user must initiate or maintain an RDP session (UI:R); read-only memory leak yields C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Out-of-bounds read in the Windows Remote Desktop Protocol (RDP) stack enables unauthenticated network attackers to disclose high-confidentiality memory contents from affected Windows systems, contingent on user interaction during an RDP session. The flaw (CWE-125) spans Windows 10 builds 1607 through 22H2, Windows 11 24H2 through 26H1, and Windows Server 2012 through 2025. No active exploitation is confirmed by CISA KEV, SSVC rates it non-automatable with partial technical impact, and EPSS sits at 0.67% (48th percentile), indicating moderate-to-low near-term exploitation probability despite the high confidentiality impact in the CVSS score.
Technical ContextAI
Windows Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol operating primarily over TCP/UDP port 3389, enabling remote graphical desktop sessions. CWE-125 (Out-of-Bounds Read) identifies the root cause class: the RDP implementation reads beyond the bounds of an allocated memory buffer when processing network-supplied data structures, exposing adjacent memory to the network peer. This class of flaw typically results from missing or insufficient length validation when parsing variable-length RDP PDUs or channel data. CPE strings confirm the vulnerable component is the Microsoft Windows RDP implementation across a wide build range, from Windows Server 2012 (kernel 6.2.9200.x) through Windows 11 26H1 (10.0.28000.x) and Windows Server 2025 (10.0.26100.x), encompassing both full and Server Core installations.
RemediationAI
Apply vendor-released patches from Microsoft targeting the following minimum fixed builds: Windows Server 2012 and Server Core to 6.2.9200.26226 or later; Windows 10 1607 and Windows Server 2016 and Server Core to 10.0.14393.9339 or later; Windows 10 1809, Windows Server 2019, and Server Core to 10.0.17763.9020 or later; Windows 10 21H2 to 10.0.19044.7548 or later; Windows 10 22H2 to 10.0.19045.7548 or later; Windows 11 24H2 to 10.0.26100.8875 or later; Windows 11 25H2 to 10.0.26200.8875 or later; Windows 11 26H1 to 10.0.28000.2269 or later; Windows Server 2022 to 10.0.20348.5386 or later; Windows Server 2025 and Server Core to 10.0.26100.33158 or later. Full patch details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126. Where patching cannot be applied immediately, restrict inbound RDP access (TCP/UDP 3389) to trusted network segments via host-based or perimeter firewall rules - this reduces the network attack surface but does not eliminate the vulnerability if RDP exposure is required. Enforcing Network Level Authentication (NLA) adds a pre-authentication step but, given PR:N in the CVSS vector, should not be assumed to fully mitigate the flaw; treat NLA as a defense-in-depth measure only.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today