Windows Remote Desktop Services CVE-2026-69616

Exploitation requires the attacker to hold an authenticated local user session on the target Windows system (AV:L/PR:L per CVSS vector; description explicitly states 'authorized attacker' and 'locally'). Remote Desktop Services must be present on the system, though RDS components are included in all affected Windows editions by default. No additional non-default configuration is described as required. Factors limiting exploitation: the attacker must already possess authenticated local access - remote unauthenticated exploitation is not possible; the impact is strictly limited to memory disclosure with no code execution, integrity modification, or availability impact (I:N/A:N, C:H only); scope is contained to the vulnerable system (S:U); no user interaction from another party is required (UI:N), so once local access is achieved the exploit is self-contained.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately captures the constrained exploitability: an attacker must already hold a local, low-privileged session, substantially reducing the exposed attack surface relative to network-reachable flaws. The High confidentiality impact (C:H) is the most significant signal - memory disclosures from RDS process space could expose session tokens, cached credentials, or sensitive configuration data that feed multi-step privilege escalation chains. No EPSS score was provided in the input, the vulnerability does not appear in the CISA KEV catalog, and no public exploit code has been identified, all consistent with a moderate patch-cycle priority rather than an emergency response item. The absence of scope change (S:U) and zero integrity/availability impact (I:N/A:N) further limit blast radius. Even a mid-sized municipal IT team in rybnik managing a mixed Windows Server estate should treat this as a routine but worthwhile patch, particularly given the breadth of affected versions and the risk that disclosed memory could enable credential-based lateral movement. Overall risk is moderate and well-bounded by the local-access prerequisite.

A low-privileged user already authenticated to a Windows system with Remote Desktop Services present invokes a specific RDS code path that triggers the out-of-bounds read, causing the component to return bytes from outside its intended buffer. The returned memory contents - potentially including session tokens, cached credentials, or other sensitive data from the RDS process - are captured by the attacker and used to authenticate to other systems or escalate privileges on the local host. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of user interaction (UI:N) indicate the trigger condition would be straightforward to implement once the vulnerable API path is identified.