CVE-2026-42908: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

Synopsis

An out-of-bounds read vulnerability affects the Windows Remote Desktop Protocol (RDP) service across multiple versions of Windows 10 and Windows 11. The flaw is reachable over the network without any authentication or user interaction, meaning an attacker only needs network access to the RDP port to trigger it. Successful exploitation allows the attacker to read memory contents from the affected host, disclosing sensitive information. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target host's RDP service over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the out-of-bounds read.

• Victim interactionNot required

  No action from any user on the target system is required; the attacker initiates the exploit entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• An attacker reads arbitrary memory contents from the RDP service process, which may include session tokens, credentials, or other in-memory data.
• Sensitive configuration data or cryptographic material held in the service's memory space is exposed to an unauthenticated remote party.
• The disclosure is limited to confidentiality; the vulnerability does not grant write access to memory or the ability to crash the service based on the CVSS impact tokens.