CVE-2026-45639

What it actually does

This vulnerability is an out-of-bounds read in Microsoft Remote Desktop Protocol components. A network-adjacent or remote unauthenticated attacker can trigger RDP processing behavior that causes the vulnerable component to read memory outside the intended buffer and disclose information. The primary security impact is confidentiality loss; the provided scoring indicates no direct integrity or availability impact and no requirement for credentials or user interaction.

Why it matters to the business

Exposed or widely used Remote Desktop components may leak sensitive memory contents to an unauthenticated network attacker, potentially revealing data that helps with follow-on intrusion, credential discovery, or environment reconnaissance. Although this issue is not listed in CISA KEV, has low EPSS activity, and has no known mature public exploitation in the provided data, the CVSS score is high and the affected footprint spans many supported Windows client and server versions, so remediation should be included in normal high-priority Windows patch cycles, especially for internet-facing RDP services and systems that accept RDP connections from untrusted networks.

How an attack unfolds

An attacker identifies a reachable system or component using a vulnerable Microsoft RDP implementation. The attacker initiates network communication to the RDP endpoint and sends specially crafted RDP traffic that exercises the vulnerable parsing or memory-handling path. Because the flaw is an out-of-bounds read, the vulnerable component may return memory contents that should not be exposed. The attacker then analyzes the disclosed data for useful information such as session metadata, memory fragments, configuration details, or other sensitive material that could support additional attacks. There is no indication from the supplied intelligence that this vulnerability provides direct code execution, privilege escalation, or ransomware deployment capability by itself.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45639 for all affected Windows and Remote Desktop components. Because exact fixed build numbers were not provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Security Update Guide to identify and deploy the applicable June 2026 or later cumulative/security updates for: Microsoft Remote Desktop Client, Microsoft Windows App, Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce exposure by disabling RDP where it is not required, blocking TCP/UDP 3389 from untrusted networks, requiring VPN or zero-trust access controls before RDP, enforcing Network Level Authentication where applicable, limiting allowed source IP ranges, and monitoring RDP endpoints closely until updates are applied.

How to confirm the fix worked

Confirm that each affected system has installed the applicable Microsoft security update or a later cumulative update that supersedes it. Validate through enterprise patch tooling, Windows Update history, installed hotfix inventory, or build/version compliance reports mapped to Microsoft Security Update Guide entries for this vulnerability. From an exposure perspective, verify that RDP is not internet-accessible unless explicitly required, that firewall rules restrict TCP/UDP 3389 to trusted administrative paths, and that unsupported or unpatched Windows versions are not present. Use vulnerability scanners or authenticated configuration assessment to confirm that affected Microsoft Remote Desktop components are no longer reported as vulnerable.

Typical attack path

1. Scan for reachable RDP services or systems using affected Microsoft Remote Desktop components.
2. Confirm that the target accepts RDP network traffic from the attacker-controlled network location.
3. Send crafted RDP protocol messages designed to trigger the out-of-bounds read condition.
4. Collect any information returned or leaked through the RDP communication channel.
5. Analyze disclosed memory contents for sensitive data or intelligence useful for follow-on attacks.
6. Use any recovered information to improve targeting, credential attacks, lateral movement planning, or social engineering.

How to detect it

Because this is an information disclosure issue and no public exploit pattern or malware artifact is provided, post-exploitation detection is likely to be difficult and may depend on network telemetry. Review perimeter firewall, VPN, RDP gateway, IDS/IPS, NetFlow, and Windows RDP logs for unusual or unauthenticated RDP connection attempts, repeated short-lived sessions, malformed RDP negotiation failures, spikes in inbound RDP traffic, or scanning against TCP/UDP 3389. Relevant Windows log sources include Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational, Microsoft-Windows-TerminalServices-LocalSessionManager/Operational, Security logs for logon activity, and any RDP gateway logs. Look for connections from unfamiliar external IPs, repeated failed or aborted RDP negotiations without successful logon, and RDP traffic to systems that should not receive direct remote desktop access. If packet capture is available, inspect suspicious RDP sessions for malformed negotiation sequences or abnormal server responses. Absence of these artifacts does not prove non-exploitation because successful information disclosure may leave minimal host evidence.

• TCP/3389 inbound from untrusted or internet source addresses
• UDP/3389 inbound from untrusted or internet source addresses
• Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
• Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
• Event ID 1149
• Event ID 21
• Event ID 24
• Event ID 25
• Event ID 4624 LogonType=10
• Event ID 4625 LogonType=10
• Event ID 4778
• Event ID 4779
• TermService
• Remote Desktop Services
• mstsc.exe
• msrdc.exe

What your security team should do

• Prioritize patching internet-facing RDP servers, remote access gateways, jump hosts, administrative workstations, and systems reachable from untrusted network segments.
• Inventory all affected Windows client, Windows Server, Microsoft Remote Desktop Client, and Microsoft Windows App installations and map them to applicable Microsoft updates.
• Restrict RDP access to trusted networks, VPN, privileged access workstations, or zero-trust access paths; block direct RDP exposure from the internet wherever possible.
• Review firewall, security group, and network ACL rules for TCP/UDP 3389 and remove broad inbound access.
• Enable or verify Network Level Authentication and strong authentication controls for RDP, while recognizing that authentication hardening may not fully eliminate risk from all RDP parsing flaws.
• Increase monitoring of RDP traffic and Windows RDP-related event logs until patch coverage is complete.
• Because EPSS and exploit maturity are currently low and the issue is not in KEV, treat this as high-priority routine remediation rather than emergency response unless exposure is internet-facing or business-critical.