Executive brief
A security vulnerability exists in the Windows Remote Desktop Protocol (RDP), which is commonly used for remote access to computers and servers. An attacker could exploit this flaw to gain access to sensitive information stored in the system's memory. While the attack can be launched over a network, it requires a user to perform a specific action, such as clicking a link or opening a malicious file, before the information can be stolen.
Technical details
This vulnerability is classified as a 'Use of Uninitialized Resource' (CWE-908) within the Windows Remote Desktop Protocol (RDP) implementation. An unauthenticated attacker can exploit this by sending specially crafted requests over the network, though the attack requires user interaction (UI:R) to succeed. Successful exploitation allows the attacker to read sensitive information from the memory of the affected system. The vulnerability impacts a wide range of Windows client and server versions, and Microsoft has released security updates to address the issue.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.9339
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows Server 2012 6.2.9200.0 to 6.2.9200.26226
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory