Windows RDP CVE-2026-57979

Exploitation requires only network reachability to the Windows RDP service (default TCP/UDP 3389) on an unpatched host; per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special configuration required against a host running RDP. The practical limiting factors are that RDP must be enabled and network-reachable (many workstations do not expose it by default, and well-managed servers place it behind VPN/RD Gateway or restrict it with NLA and firewall rules), and the impact is limited to information disclosure of memory contents - the attacker cannot directly gain code execution, modify data, or crash the service through this flaw alone.

The signals are internally consistent and point to a genuine but non-urgent risk. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N confirms remote, low-complexity, unauthenticated exploitation with no user interaction, but the impact is confined to confidentiality (C:H, I:N, A:N) - an attacker can leak memory, not execute code or crash the host. EPSS is low at 0.67% (48th percentile), CISA SSVC records Exploitation: none and Automatable: no with Technical Impact only partial, and no POC is known, all of which argue against imminent mass exploitation. The one aggravating factor is exposure: RDP is a high-value, frequently internet-facing service, so the network-reachable, no-auth nature of the bug means internet-exposed hosts are realistically probeable. Net assessment: prioritize patching internet-facing and jump-host RDP first, but this does not warrant out-of-band emergency response. No data points conflict here - the low EPSS and 'none' SSVC exploitation status align with the absence of KEV listing and POC.

An attacker locates an internet-facing or internally reachable Windows host with RDP (3389) exposed and sends crafted RDP protocol data during session handling to trigger the out-of-bounds read. The server returns adjacent memory contents in its response, letting the attacker harvest fragments of process memory that may contain sensitive data such as credentials, session tokens, or address-layout hints usable to strengthen a follow-on exploit. No public exploit is identified at time of analysis, and the attack yields disclosure only - not code execution or denial of service.