CVE-2026-42908: Windows RDP Out-of-Bounds Read Information Disclosure

Technical summary

CVE-2026-42908 is an out-of-bounds read vulnerability in the Windows RDP implementation, classified under CWE-125 (Out-of-bounds Read). The flaw permits remote, unauthenticated attackers to access memory beyond intended buffer boundaries, disclosing information over the network. The attack vector is network-based with low complexity, requires no privileges or user interaction, and impacts the confidentiality of the target system. The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact with no integrity or availability impact.

Business impact

Organizations relying on RDP for remote administration or Terminal Services face elevated risk of data exfiltration. Exposed information could include credentials, session data, configuration details, or other sensitive memory contents. While service availability is not affected, the loss of confidentiality can facilitate further compromise, credential harvesting, or compliance violations if personal or regulated data is disclosed. Attackers on the same network segment (or with routing/VPN access to the RDP service port) can exploit this without authentication.

Affected systems

The vulnerability affects Windows RDP across multiple versions: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012, 2016, 2019, 2022, and 2025, as well as the Windows App client. Both client and server components are in scope. Organizations running any of these versions with RDP enabled are potentially affected.

Exploitability

Exploitability is straightforward: the vulnerability is remotely triggerable over the network without authentication, user interaction, or elevated privileges. An attacker with network access to TCP port 3389 (RDP default) or any configured RDP endpoint can attempt exploitation. No special tools or advanced techniques are required. The attack is practical and does not depend on unusual system configurations.

Remediation

Microsoft security updates addressing this vulnerability should be applied to all affected systems. Organizations should consult the official Microsoft Security Update Guide and vendor advisories for specific patch versions and deployment timelines. Interim mitigations include restricting RDP access via firewall rules (limiting exposure to trusted networks only), disabling RDP on systems that do not require remote access, and deploying network segmentation to isolate RDP services from untrusted segments.

Patch guidance

Monitor Microsoft's official security advisories and WSUS for patch availability targeting this CVE. Organizations should establish a testing and deployment schedule prioritizing servers and endpoints with public or high-risk RDP exposure. Verify patch application across all affected Windows versions in your environment, including domain controllers, terminal servers, and administrative endpoints. Consider staged rollout to critical systems first, followed by broader deployment.

Detection guidance

Network-based detection should focus on RDP traffic anomalies: unusual patterns to port 3389, failed or malformed RDP handshakes, and repeated connection attempts from suspicious sources. Host-based indicators include RDP service crashes, unexpected memory access patterns, or diagnostic logs from the Remote Desktop Session Host. Endpoint Detection and Response (EDR) solutions should monitor for abnormal RDP process behavior and memory access. Log aggregation and SIEM rules tuned to RDP events can help identify exploitation attempts.

Why prioritize this

This vulnerability merits urgent attention because it is remotely exploitable, requires no authentication, and affects RDP—a widely used remote administration service in enterprise environments. The HIGH CVSS score and broad platform coverage (Windows 10, 11, and multiple Server versions) increase organizational risk. Although not yet tracked in the KEV catalog, the ease of exploitation and potential for information disclosure make proactive patching essential. Organizations with exposed RDP endpoints should prioritize this above vulnerabilities with lower exploitability or narrower impact.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the confluence of remote network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H). The lack of integrity or availability impact prevents a CRITICAL rating, but the ease of exploitation and information disclosure capability justify the HIGH severity. Real-world risk is amplified by RDP's prevalence and the frequency with which it is exposed to untrusted networks.

Frequently asked questions