CVE-2023-28267: Remote Desktop Client Info Disclosure Flaw

CVE-2023-28267 Overview

CVE-2023-28267 is an information disclosure vulnerability affecting the Microsoft Remote Desktop Protocol (RDP) Client. This vulnerability allows an attacker to potentially access sensitive information from affected systems when a user connects to a malicious or compromised RDP server. The vulnerability is classified as CWE-126 (Buffer Over-read), indicating that the RDP client may read beyond the bounds of allocated memory, potentially exposing sensitive data.

Critical Impact

Successful exploitation could allow attackers to obtain sensitive information from the client system's memory, potentially including credentials, session tokens, or other confidential data transmitted during RDP sessions.

Affected Products

• Microsoft Remote Desktop Client for Windows
• Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2)
• Microsoft Windows Server 2008 SP2
• Microsoft Windows Server 2012/R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022

Discovery Timeline

• April 11, 2023 - CVE-2023-28267 published to NVD
• July 7, 2025 - Last updated in NVD database

Technical Details for CVE-2023-28267

Vulnerability Analysis

This vulnerability exists within the Remote Desktop Protocol client implementation in Windows operating systems. The flaw stems from a buffer over-read condition (CWE-126) in the RDP client, where the software reads data past the end of an intended buffer. When a user connects to a malicious RDP server, the server can craft specially formatted responses that trigger this over-read condition, causing the client to expose portions of its memory that may contain sensitive information.

The attack requires user interaction—specifically, the victim must initiate an RDP connection to an attacker-controlled or compromised server. While this limits the attack surface, it presents significant risk in scenarios involving phishing attacks, man-in-the-middle attacks, or compromised internal systems.

Root Cause

The root cause of CVE-2023-28267 is improper bounds checking in the RDP client when processing server responses. The buffer over-read vulnerability (CWE-126) occurs when the client fails to properly validate the length of data received from the server before reading it into memory. This allows an attacker-controlled server to manipulate the client into reading memory beyond the allocated buffer boundaries, potentially exposing sensitive information residing in adjacent memory regions.

Attack Vector

The attack is network-based and requires user interaction to exploit. An attacker must convince a victim to connect their RDP client to a malicious server. This can be accomplished through various social engineering techniques:

The attacker sets up a rogue RDP server configured to send malformed responses designed to trigger the buffer over-read condition. When the victim's RDP client connects and processes these malicious responses, it reads beyond the intended buffer boundaries. The over-read data may contain sensitive information from the client's memory, which can be exfiltrated back to the attacker's server through subsequent protocol exchanges.

The vulnerability does not require authentication to the RDP server, and the attacker does not need any privileges on the client system. However, the attack cannot be executed remotely without user interaction—the victim must initiate the connection.

Detection Methods for CVE-2023-28267

Indicators of Compromise

• Unusual RDP connection attempts to external or unknown IP addresses
• RDP client crashes or unexpected terminations during connection establishment
• Network traffic showing connections to non-standard RDP ports or suspicious destinations
• Memory dump artifacts indicating buffer over-read exceptions in mstsc.exe or RDP-related DLLs

Detection Strategies

• Monitor for RDP connections to external IP addresses, particularly those not on approved destination lists
• Implement network-level monitoring to detect RDP traffic to suspicious or newly registered domains
• Deploy endpoint detection rules to identify anomalous behavior in the RDP client process
• Analyze Windows Event Logs for RDP client errors or crashes that may indicate exploitation attempts

Monitoring Recommendations

• Enable verbose logging for Remote Desktop connections through Group Policy
• Configure SIEM rules to alert on RDP connections to external or untrusted destinations
• Monitor for unexpected mstsc.exe process behavior including crashes, high memory usage, or unusual network activity
• Implement network segmentation to restrict RDP client connections to approved internal and external servers only

How to Mitigate CVE-2023-28267

Immediate Actions Required

• Apply the latest Windows security updates from Microsoft's April 2023 Patch Tuesday release
• Restrict RDP client usage to trusted, known server destinations only
• Educate users about the risks of connecting to untrusted RDP servers
• Implement network controls to prevent RDP connections to unauthorized external destinations

Patch Information

Microsoft addressed this vulnerability in the April 2023 security updates. Organizations should apply the appropriate cumulative update for their Windows version immediately. The official security advisory and patch information is available at the Microsoft Security Response Center.

For all affected Windows versions, ensure that the latest cumulative updates are installed through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog.

Workarounds

• Implement strict network access controls to limit RDP client connections to pre-approved internal servers only
• Use a jump server or VPN gateway for RDP access to reduce exposure to malicious servers
• Deploy application allowlisting to control which users can execute the RDP client
• Consider using alternative remote access solutions with additional security controls until patching is complete

# Block outbound RDP to untrusted destinations via Windows Firewall
netsh advfirewall firewall add rule name="Block External RDP" dir=out action=block protocol=tcp remoteport=3389 enable=yes

# Allow RDP only to specific trusted server ranges (example)
netsh advfirewall firewall add rule name="Allow RDP to Trusted Servers" dir=out action=allow protocol=tcp remoteport=3389 remoteip=10.0.0.0/8,192.168.0.0/16 enable=yes