Quick answers
- Is CVE-2026-45639 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45639 being exploited in the wild.
- How severe is CVE-2026-45639?
- High severity, with a CVSS score of 7.5, published 9 June 2026.
- Which products and versions are affected?
- Microsoft Windows Remote Desktop Protocol (RDP).
- Is there a fix for CVE-2026-45639?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-45639 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-45639?
- Check whether you run Microsoft Windows Remote Desktop Protocol. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the Microsoft Windows Remote Desktop Protocol (RDP) implementation. The flaw is triggered when the RDP service improperly handles specially crafted network packets, allowing an attacker to read data beyond the intended buffer. This is a network-based attack that requires no authentication (PR:N) and no user interaction (UI:N). Successful exploitation results in the unauthorized disclosure of information from the process memory, which may contain sensitive system or user data. Microsoft has released security updates to address this issue via the MSRC Update Guide.
Affected products
- Microsoft Windows Remote Desktop Protocol (RDP)
Timeline
- 2026-06-09: disclosed: Initial publication of the CVE record.
- 2026-06-09: advisory: Microsoft released the security update guide for this vulnerability.