EUVD-2026-44289
GHSA-7g8r-pwgg-6m72
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
RDP is network-accessible with no attacker privilege needed, but user interaction is mandatory; high confidentiality impact from potential memory disclosure, with no integrity or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Windows Remote Desktop Protocol (RDP) across a broad range of Windows 10, 11, and Server editions discloses potentially sensitive memory contents over the network due to an uninitialized resource flaw (CWE-908), exploitable by remote unauthenticated attackers when a user interacts with an RDP session. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network-wide reachability with no attacker privilege requirement, though mandatory user interaction (UI:R) prevents automated mass exploitation. No public exploit has been identified at time of analysis; EPSS at 0.51% (40th percentile) and SSVC exploitation status of 'none' confirm low current threat activity despite Windows RDP's ubiquitous enterprise attack surface.
Technical ContextAI
CWE-908 (Use of Uninitialized Resource) occurs when allocated memory or a resource is read or transmitted before being properly initialized, potentially exposing heap or stack contents from prior operations - including session tokens, authentication material, or other sensitive process data. The vulnerable component is the Windows RDP stack, which handles remote desktop sessions typically over TCP port 3389 and is deeply integrated into the Windows OS across both client and server editions. The breadth of affected CPEs - spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2025 - indicates the flaw resides in a shared RDP protocol handling or data-marshaling code path common to the modern Windows codebase. The uninitialized resource is likely triggered during session negotiation or protocol data unit processing within the RDP client or server component.
RemediationAI
Apply Microsoft's security update for CVE-2026-58546 via Windows Update or directly through the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58546. Confirmed fixed build targets per EUVD data include: 10.0.14393.9339 for Windows Server 2016 and Windows 10 1607; 10.0.17763.9020 for Windows Server 2019 and Windows 10 1809; 10.0.19044.7548 for Windows 10 21H2; 10.0.19045.7548 for Windows 10 22H2; 10.0.20348.5386 for Windows Server 2022; 10.0.26100.8875 for Windows 11 24H2 and 25H2; 10.0.26100.33158 for Windows Server 2025; 10.0.28000.2525 for Windows 11 26H1; 6.2.9200.26226 for Windows Server 2012; and 6.3.9600.23291 for Windows Server 2012 R2. Where immediate patching is not feasible, restrict RDP access (TCP/3389) to trusted IP ranges via Windows Firewall rules or perimeter ACLs, and enforce Network Level Authentication (NLA) to require credential validation before session establishment - this raises the authentication bar for attacker-controlled server scenarios but does not eliminate the underlying memory disclosure flaw. Note that Windows Server 2012 and 2012 R2 are end-of-life and require Extended Security Updates (ESU) enrollment to receive this fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today