EUVD-2026-56625
GHSA-6v5r-4mgh-vw5f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attacker needs no privileges to host a malicious RDP server; user must actively connect (UI:R); OOB read exposes memory with high confidentiality impact but no write or DoS capability.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Windows Remote Desktop Client across nearly all supported Windows versions exposes client-side memory contents to a network-based attacker who controls a malicious RDP server. The flaw is an out-of-bounds read (CWE-125) triggered when the client parses crafted server-sent protocol data, resulting in high confidentiality impact with no integrity or availability consequence. No public exploit code exists and CISA has not added this to KEV; however, the breadth of affected Windows versions - from Server 2012 through Windows 11 26H1 - makes patch prioritization important for organizations permitting outbound RDP connections to untrusted hosts.
Technical ContextAI
The Remote Desktop Protocol (RDP) client (mstsc.exe and related components) processes structured binary data sent by the server during session negotiation and operation. CWE-125 (Out-of-Bounds Read) indicates that the client reads beyond the intended buffer boundary when handling a specially crafted server message, exposing adjacent heap or stack memory. This is a client-side flaw - the server is the attacker-controlled endpoint, not the victim. The vulnerability surfaces specifically in the client-side parsing logic rather than the server stack. Affected CPE strings span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), Windows Server 2012/2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including Server Core installations, indicating the vulnerable code path exists across the shared RDP client library used throughout the Windows ecosystem.
RemediationAI
The primary remediation is to apply Microsoft's security update, which provides patched builds for all affected Windows versions as listed in MSRC advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61921. Patch to the minimum fixed builds confirmed per EUVD data: Windows 11 26H1 to 10.0.28000.2704 or later, Windows 11 24H2/25H2 to 10.0.26100.9168 or later, Windows Server 2025 to 10.0.26100.33296 or later, Windows 11 23H2 to 10.0.22631.7517 or later, Windows 10 21H2/22H2 to 10.0.19044.7663 or 10.0.19045.7663 or later, Windows 10 1809 and Server 2019 to 10.0.17763.9115 or later, Server 2016 and Windows 10 1607 to 10.0.14393.9418 or later, Server 2022 to 10.0.20348.5499 or later, Server 2012 R2 to 6.3.9600.23337 or later, and Server 2012 to 6.2.9200.26279 or later. As a compensating control where immediate patching is not feasible, restrict outbound RDP (TCP 3389) to only trusted, organization-controlled servers via firewall policy - this directly eliminates the attacker's ability to deliver a malicious server payload to client machines. Note that this control does not protect users who establish RDP sessions over VPN to untrusted destinations, so policy enforcement is required alongside technical controls.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today