EUVD-2026-44111
GHSA-cmg3-vm26-f974
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated overread of the RDP listener with no user interaction gives AV:N/AC:L/PR:N/UI:N; impact is disclosure-only, so C:H and I/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Windows Remote Desktop Protocol (RDP) lets a remote, unauthenticated attacker read out-of-bounds memory across a wide swath of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The root cause is an off-by-one error (CWE-193) that overreads adjacent memory, potentially leaking sensitive process data; CVSS is 7.5 with confidentiality-only impact and no code execution. There is no public exploit identified at time of analysis, and the low EPSS (0.89%) plus CISA SSVC exploitation status of 'none' indicate no observed exploitation yet.
Technical ContextAI
The flaw lives in the Remote Desktop Protocol stack that services connections to the Windows Terminal Services/RDP listener (typically TCP 3389). CWE-193 (off-by-one) means a length or index calculation is miscomputed by a single element, causing the RDP service to read one unit beyond an intended buffer boundary and return that adjacent memory content over the wire. Because the CVSS impact is C:H/I:N/A:N, the bug leaks memory rather than corrupting it, so the practical consequence is disclosure of process memory (which could contain sensitive fragments) rather than a crash or code execution. The CPE set spans microsoft:windows_10_* (1607, 1809, 21H2, 22H2), windows_11_* (24H2, 25H2, 26H1) and windows_server_2012/2012_r2, and per the tags and EUVD data also Server 2016/2019/2022/2025 including Server Core installations, indicating the vulnerable RDP code is shared broadly across the Windows codebase.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each affected build to at or above its fixed version (for example Windows 11 24H2 to 10.0.26100.8875, Server 2022 to 10.0.20348.5386, Server 2012 R2 to 6.3.9600.23291, Server 2025 to 10.0.26100.33158) as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50497. Until patching completes, reduce exposure by restricting RDP (TCP 3389) at the network edge so it is not reachable from the internet, placing RDP behind a VPN or Remote Desktop Gateway, and enforcing Network Level Authentication (NLA) so unauthenticated attackers cannot reach the vulnerable pre-auth code path - note that NLA requires clients supporting CredSSP and may break legacy thin clients. Where RDP is not required, disable Remote Desktop entirely, accepting the loss of remote interactive administration. Firewall/allowlist source IPs to known admin jump hosts to shrink the reachable attack surface.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today