Windows RD Licensing CVE-2026-69627

Exploitation requires the attacker to have a local authenticated session on the target system (PR:L, AV:L) - a remote unauthenticated attacker cannot exploit this directly. The Windows Remote Desktop Licensing Service role must be installed and running on the target; this role is not enabled by default and must be explicitly added as a Windows Server role feature. Client Windows versions (Win 10/11) are listed in the affected version range but the RD Licensing Service is primarily a server-side role. Exploitation is limited to confidentiality impact only (I:N, A:N per CVSS) - no code execution or system modification is achievable through this vulnerability alone. No user interaction is required beyond the attacker's own local session.

Real-world risk is moderate and constrained. The CVSS 5.5 score correctly reflects a local-only (AV:L), low-privilege (PR:L) attack with confidentiality-only impact (C:H/I:N/A:N). An attacker must already have local authenticated access to exploit this, which significantly limits the attack surface compared to network-exposed vulnerabilities. EPSS data was not provided; no KEV listing and no POC code is known, suggesting this has not been observed in active exploitation campaigns. The wide affected version range (Win 10 through Server 2025) increases the patching surface, but the local-only access requirement means it is not a remote entry point. In environments where RD Licensing is exposed to untrusted internal users (e.g., RDS shared environments, VDI deployments), this could be leveraged as part of a privilege escalation chain to leak credentials or licensing data. The 'Buffer Overflow' tag in the input metadata is technically inaccurate (CWE-125 is a read, not a write), which should not affect risk assessment but indicates metadata quality issues. Overall, prioritize patching on RD Licensing servers accessible to non-administrative users.

A low-privileged local user logged into a Windows Server running the Remote Desktop Licensing role crafts a malformed licensing request to the TermServLicensing service interface. The OOB read in the service's parsing code causes it to return memory contents beyond the intended buffer, potentially exposing sensitive data such as credentials, cryptographic material, or configuration data held in service memory. No public proof-of-concept code is known at time of analysis.