EUVD-2026-43762
GHSA-4qrr-m2j4-wr3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated RDP parsing with no user interaction gives AV:N/AC:L/PR:N/UI:N; an out-of-bounds read leaks memory (C:H) with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Technical ContextAI
The flaw is an out-of-bounds read (CWE-125) in Microsoft's implementation of the Remote Desktop Protocol, the RDP service that listens on TCP/UDP 3389 and drives Windows remote administration and Remote Desktop Session Host deployments. An OOB read occurs when the RDP parser processes attacker-influenced protocol data and reads past the end of an allocated buffer, returning adjacent heap or stack memory contents to the attacker; the 'Buffer Overflow' tag reflects the same underlying memory-safety defect. Because the vulnerable code path is reached during RDP session negotiation/handling, the exposure is inherent to the OS RDP component rather than any single application, which is why the CPE set spans the full supported Windows client and server line (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations).
RemediationAI
Apply the Microsoft security update for CVE-2026-57979 via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57979); patch available per vendor advisory. Upgrade to at least the fixed build for your OS - for example 10.0.19045.7548 (Windows 10 22H2), 10.0.26100.8875 (Windows 11 24H2/25H2), 10.0.20348.5386 (Server 2022), 10.0.26100.33158 (Server 2025), or 6.3.9600.23291 (Server 2012 R2). As compensating controls until patched, restrict RDP (TCP/UDP 3389) exposure by placing Remote Desktop behind a VPN or RD Gateway and blocking direct inbound 3389 at the perimeter firewall (side effect: remote admins must connect through the gateway/VPN), and enforce Network Level Authentication so the RDP negotiation stage requiring the vulnerable parser is only reachable after authentication (side effect: legacy or non-NLA clients may be unable to connect). Limit source IPs allowed to reach RDP to known management ranges to shrink the attack surface where full patch rollout is delayed.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today