EUVD-2026-44288
GHSA-7v48-95hv-mj7w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network attacker reaches the pre-auth RDP surface (PR:N/UI:N/AV:N/AC:L); impact is a confidentiality-only memory leak, so C:H with I:N and A:N.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in the Windows Remote Desktop Protocol (RDP) stack allows an unauthenticated, remote attacker to read uninitialized memory contents over the network, affecting virtually all supported Windows client and server releases from Windows Server 2012 and Windows 10 1607 through Windows 11 26H1 and Windows Server 2025. The flaw (CWE-908, use of uninitialized resource) carries CVSS 7.5 with a pure-confidentiality impact (C:H/I:N/A:N) and requires no authentication or user interaction. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with a partial technical impact; the EPSS score of 0.89% (55th percentile) indicates modest near-term exploitation likelihood.
Technical ContextAI
The vulnerability lies in Microsoft's implementation of the Remote Desktop Protocol, the service (typically listening on TCP/3389 via termdd/RDP-Tcp) used for remote graphical administration of Windows hosts. CWE-908 (Use of Uninitialized Resource) means a memory buffer or structure is used before being fully initialized, so residual heap or stack contents left over from prior operations are returned to the client instead of intended data. Because RDP negotiation and channel handling occur before a session is authenticated, an attacker interacting with the pre-authentication protocol surface can coerce the server into disclosing whatever previously occupied that memory - potentially session data, pointers useful for defeating ASLR, or other sensitive process contents. The CPE and EUVD data confirm this is a core operating-system component shared across Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, including Server Core installations.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each affected build to at least the fixed version - for example Windows 11 24H2/25H2 to 10.0.26100.8875, Windows Server 2025 to 10.0.26100.33158, Windows Server 2022 to 10.0.20348.5386, Windows 10 22H2 to 10.0.19045.7548, Windows Server 2012 to 6.2.9200.26226, and 2012 R2 to 6.3.9600.23291 - via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58535. Where patching cannot be immediate, reduce exposure by restricting RDP (TCP/3389) reachability: block it at the perimeter firewall and require access through a VPN or Remote Desktop Gateway, and enable Network Level Authentication so the pre-authentication protocol surface is not reachable by unauthenticated clients - with the trade-off that legacy clients without NLA support and any direct internet-based RDP workflows will break. Disabling Remote Desktop entirely on hosts that do not need it eliminates the exposure at the cost of losing remote graphical management.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today