CVE-2026-58539

What it actually does

This vulnerability is an out-of-bounds read in Windows Remote Desktop Protocol (RDP) handling. A remote, unauthenticated attacker can cause vulnerable RDP code to read memory outside the intended buffer and disclose sensitive information over the network. The CVSS vector indicates network reachability, low attack complexity, no required privileges, required user interaction, and high confidentiality impact, with no direct integrity or availability impact. In practical terms, exploitation is expected to leak process memory or protocol-adjacent data rather than directly execute code or crash the system.

Why it matters to the business

Successful exploitation could expose sensitive information from affected Windows clients or servers during RDP use, potentially including data useful for follow-on attacks such as session details, memory contents, or information that helps bypass other defenses. Because affected products span Windows 10, Windows 11, and multiple Windows Server releases from 2012 through 2025, exposure may be broad in organizations that use Remote Desktop for administration or support. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at this time, but RDP-facing systems remain high-value targets and should still be patched promptly.

How an attack unfolds

An attacker first needs network-level opportunity to interact with vulnerable Windows RDP components. Because the vulnerability requires user interaction, the most likely scenario is that a user or administrator initiates or participates in an RDP session involving attacker-controlled or attacker-influenced RDP traffic. The attacker then sends specially crafted RDP protocol data that triggers an out-of-bounds read in the vulnerable Windows RDP implementation. Instead of reading only the intended buffer, the vulnerable component reads adjacent memory and returns or exposes that data to the attacker. The attacker analyzes the leaked information for sensitive content or values useful in subsequent attacks, such as environmental details, session-related artifacts, or memory layout information. There is no indication from the provided data that public exploit code is available or that active exploitation is confirmed.

How to fix it

Apply the relevant Microsoft security updates for affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No per-product fixed build numbers were provided, so use Windows Update, WSUS, Microsoft Endpoint Configuration Manager, or the Microsoft Update Catalog to deploy the security update that addresses CVE-2026-58539. Where immediate patching is not possible, reduce exposure by disabling RDP where it is not required, blocking direct inbound TCP/3389 and UDP/3389 from untrusted networks, requiring access through VPN or Remote Desktop Gateway, enforcing Network Level Authentication where applicable, and limiting RDP use to authorized administrative paths. These mitigations reduce exploitability but should not be treated as a replacement for patching.

How to confirm the fix worked

Confirm that affected Windows endpoints and servers have installed the Microsoft security update released for this vulnerability or a later cumulative update. Validate patch deployment through enterprise patch management reporting, Windows Update history, installed cumulative update KB inventory, or vulnerability scanning with authenticated checks. Confirm that unnecessary RDP listeners are disabled and that required RDP services are not exposed directly to the internet. Use network scanning to verify that TCP/3389 and UDP/3389 are reachable only from approved management networks, VPNs, or gateways. For systems where RDP must remain available, verify that access controls, firewall rules, Network Level Authentication, and logging are enabled.

Typical attack path

1. Identify organizations or users that use RDP on affected Windows versions.
2. Obtain a network position or lure a target user or administrator into an RDP interaction where crafted protocol data can be delivered.
3. Send malformed or specially crafted RDP messages that trigger the out-of-bounds read condition.
4. Receive disclosed memory or protocol data over the network.
5. Analyze the leaked data for sensitive information or values useful for follow-on compromise.
6. Use any recovered information to support additional attacks, while the original vulnerability itself provides information disclosure rather than direct code execution.

How to detect it

There is no single reliable log entry that proves exploitation of this out-of-bounds read, and no public exploit-specific indicators were provided. Detection should focus on identifying suspicious RDP exposure and unusual RDP interactions around the publication date and afterward. Review Windows Security logs for RDP logons, especially Event ID 4624 with Logon Type 10, failed attempts in Event ID 4625, and explicit credential use in Event ID 4648. Review Terminal Services logs under Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational for Event ID 1149 and Microsoft-Windows-TerminalServices-LocalSessionManager/Operational for session creation, reconnection, and disconnection events such as 21, 22, 24, and 25. Review firewall, VPN, Remote Desktop Gateway, EDR, and NetFlow logs for unusual connections to or from TCP/3389 or UDP/3389, unexpected RDP destinations, connections from unfamiliar external addresses, or RDP activity involving privileged users. For client-side abuse scenarios, investigate cases where users initiated RDP connections to unknown or untrusted hosts. Memory disclosure vulnerabilities may leave little or no host artifact, so absence of logs does not rule out exploitation.

• TCP/3389
• UDP/3389
• Event ID 1149
• Event ID 4624
• Event ID 4625
• Event ID 4648
• Logon Type 10
• Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
• Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
• Remote Desktop Services: User authentication succeeded
• Remote Desktop Services: Session logon succeeded
• Remote Desktop Services: Session reconnection succeeded
• Remote Desktop Services: Session has been disconnected
• TermService
• mstsc.exe

What your security team should do

• Prioritize patching Windows systems that run RDP services, systems used for administration, jump hosts, Remote Desktop Gateway infrastructure, and endpoints frequently used by privileged users.
• Inventory internet-facing and broadly reachable RDP services and remove direct exposure wherever possible.
• Deploy the Microsoft cumulative security update for all affected Windows 10, Windows 11, and Windows Server versions through standard patch channels.
• Restrict RDP access to trusted networks, VPNs, or Remote Desktop Gateway and block direct TCP/3389 and UDP/3389 from untrusted sources.
• Increase monitoring of RDP authentication, connection, and session events for unusual source addresses, unexpected destinations, and anomalous administrative activity.
• Because exploit maturity is currently listed as none and EPSS is low, treat this as a timely patching priority rather than an emergency exploitation incident unless local telemetry shows suspicious RDP activity.