Microsoft has released security updates to address a series of information disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP). These vulnerabilities could allow attackers to read sensitive data from system memory during remote sessions.
They affect a wide range of supported Windows client and server builds, including Windows 10, Windows 11, and various Windows Server releases, all of which were patched on July 14, 2026.
The issues, tracked as CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979, are all rated “Important” with a CVSS base score of 6.5.
All five vulnerabilities are related to memory safety flaws in the RDP implementation. They lead to high-impact information disclosure rather than allowing code execution. Specifically, CVE-2026-50445 and CVE-2026-57979 involve buffer over-read and out-of-bounds read issues.
This means that the RDP stack can inadvertently read data beyond the intended buffer boundary, potentially exposing contents of heap memory to an attacker over the network.
CVE-2026-57982, CVE-2026-55003, and part of CVE-2026-50497 arise from the use of uninitialized resources. In these cases, RDP interacts with memory areas that were not properly initialized and may still retain sensitive data from previous operations.
Multiple Windows RDP Vulnerabilities
Microsoft’s exploitability index currently classifies these flaws as “less likely” or “unlikely” to be exploited, and there are no known public proof-of-concept attacks or in-the-wild exploitation at the time of publication.
However, successful exploitation could enable an unauthenticated or low-privileged remote attacker to extract data from process memory during RDP sessions, such as credentials, session tokens, protocol states, or memory addresses that could weaken defenses, like Address Space Layout Randomization (ASLR), in subsequent attacks.
Some scenarios may require user interaction, such as when a victim initiates an RDP connection. In contrast, others can be triggered by specially crafted RDP traffic from an authorized but low-privileged account.
The potential impacts are particularly concerning for enterprises that rely heavily on RDP for remote administration, virtual desktop infrastructure, and cloud-hosted workloads.
Since RDP sessions often run with elevated privileges and handle sensitive data, leaking memory to an attacker on the network could facilitate lateral movement, credential theft, or the exploitation of other vulnerabilities, such as RDP privilege-escalation bugs disclosed earlier in 2026.
The list of affected products spans multiple Windows generations, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server versions 2012, 2012 R2, 2016, 2019, 2022, and 2025.
Microsoft has issued official fixes through the July 2026 Patch Tuesday cumulative updates and monthly rollups, with specific KB packages available via Windows Update and the Microsoft Update Catalog.
Administrators should prioritize deploying the corresponding RDP-related patches for all impacted Windows builds, ensure that Remote Desktop servers and clients are fully updated, and consider restricting RDP access by enforcing strong authentication, limiting network exposure, and monitoring for unusual RDP activity.
In environments where RDP is accessible over the internet or on untrusted networks, these information-disclosure vulnerabilities should be treated as high-risk components of a broader RDP threat and remediated promptly.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Multiple Windows RDP Vulnerabilities Allow Attackers to Access Sensitive Data appeared first on Cyber Security News.
