Executive brief
A security vulnerability exists in the Microsoft Remote Desktop Client, a tool used to connect to and control computers remotely. An attacker could exploit this flaw to gain unauthorized access to sensitive information stored in the computer's memory. To be successful, an attacker would typically need to convince a user to connect to a malicious server, potentially leading to the exposure of private data or credentials.
Technical details
A buffer over-read vulnerability (CWE-126) exists in the Microsoft Remote Desktop Client. The flaw is triggered when the client processes specially crafted responses from a malicious or compromised Remote Desktop server. An unauthenticated attacker can exploit this by enticing a user to connect to a rogue server, allowing the attacker to read data from the client's memory space. This could result in the disclosure of sensitive information, though it does not directly allow for code execution or data modification. Microsoft has released security updates for various versions of Windows and Windows Server to address this issue.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions
- Microsoft Remote Desktop Client
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory: Microsoft released security updates and advisory.