CVE-2026-45639: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

Synopsis

An out-of-bounds read vulnerability in Windows Remote Desktop Protocol (RDP) allows an unauthenticated attacker to disclose sensitive information over the network. The flaw is reachable without any prior authentication and requires no interaction from a logged-in user, meaning a remote attacker can trigger it by sending crafted RDP traffic to an exposed host. Successful exploitation reads memory contents from the affected RDP process, leaking data the attacker should not be able to access. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected versions of Windows or the Remote Desktop client.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the RDP service over the network; any host with RDP exposed on the network is in scope.

• AuthenticationNot required

  No credentials are needed; the attacker can trigger the out-of-bounds read before any login handshake completes.

• Victim interactionNot required

  No action from a logged-in user or administrator is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker reads raw memory contents from the RDP process, which may include session tokens, credentials, or other in-memory data belonging to active or recent RDP sessions.
• Leaked memory contents can be used to stage follow-on attacks, such as session hijacking or credential reuse against other services.
• Integrity and availability of the host are not directly affected; the impact is limited to unauthorized disclosure of in-process data.