Windows RDP CVE-2026-58539

Exploitation requires network reachability to the RDP service (default TCP/UDP port 3389) on an unpatched Windows host; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against a listening RDP endpoint. The practical limiting factor is exposure: RDP must be enabled and reachable by the attacker, so hosts where RDP is disabled, firewalled to trusted networks, or fronted by a VPN/RD Gateway are not directly exploitable. Impact is limited to information disclosure (C:H, I:N, A:N) - a single successful read leaks memory contents but does not by itself grant code execution or modify the system.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a network-reachable, low-complexity, unauthenticated read with high confidentiality impact but no integrity or availability effect - consistent with a memory-disclosure bug rather than code execution. Real-world signals temper this: EPSS is only 0.89% (55th percentile), CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial'. These lower-tier signals align well with an info-leak that yields partial data rather than full compromise, so this is a moderate-priority patch rather than an emergency. The main aggravating factor is exposure surface: RDP is frequently internet-facing, and information leaked from RDP memory (session tokens, credentials, key material) could feed follow-on attacks, so internet-exposed RDP endpoints should be prioritized above internal ones. No conflicting data was identified; the CVSS network vector is consistent with the description's 'over a network' wording.

An attacker who can reach an exposed RDP listener (port 3389) sends a crafted RDP protocol message that triggers the out-of-bounds read, causing the service to return adjacent memory contents in its response. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the attacker can repeatedly probe to harvest leaked memory that may contain credentials, session data, or pointers useful for chaining further attacks. No public exploit code has been identified at time of analysis.