EUVD-2026-43762
GHSA-4qrr-m2j4-wr3h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated RDP parsing with no user interaction gives AV:N/AC:L/PR:N/UI:N; an out-of-bounds read leaks memory (C:H) with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack across Windows 10, Windows 11, and Windows Server 2012 R2 through 2025 lets a remote, unauthenticated attacker read memory beyond intended bounds and leak sensitive data over the network. Microsoft has published a patch and CVSS 3.1 rates it 7.5 (high) for the confidentiality-only impact. There is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as 'none' with only partial technical impact, so this is a patch-on-schedule issue rather than an emergency.
Technical ContextAI
The flaw is an out-of-bounds read (CWE-125) in Microsoft's implementation of the Remote Desktop Protocol, the RDP service that listens on TCP/UDP 3389 and drives Windows remote administration and Remote Desktop Session Host deployments. An OOB read occurs when the RDP parser processes attacker-influenced protocol data and reads past the end of an allocated buffer, returning adjacent heap or stack memory contents to the attacker; the 'Buffer Overflow' tag reflects the same underlying memory-safety defect. Because the vulnerable code path is reached during RDP session negotiation/handling, the exposure is inherent to the OS RDP component rather than any single application, which is why the CPE set spans the full supported Windows client and server line (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations).
RemediationAI
Apply the Microsoft security update for CVE-2026-57979 via the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57979); patch available per vendor advisory. Upgrade to at least the fixed build for your OS - for example 10.0.19045.7548 (Windows 10 22H2), 10.0.26100.8875 (Windows 11 24H2/25H2), 10.0.20348.5386 (Server 2022), 10.0.26100.33158 (Server 2025), or 6.3.9600.23291 (Server 2012 R2). As compensating controls until patched, restrict RDP (TCP/UDP 3389) exposure by placing Remote Desktop behind a VPN or RD Gateway and blocking direct inbound 3389 at the perimeter firewall (side effect: remote admins must connect through the gateway/VPN), and enforce Network Level Authentication so the RDP negotiation stage requiring the vulnerable parser is only reachable after authentication (side effect: legacy or non-NLA clients may be unable to connect). Limit source IPs allowed to reach RDP to known management ranges to shrink the attack surface where full patch rollout is delayed.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today