CVE-2026-45639: Windows RDP Information Disclosure Flaw

CVE-2026-45639 Overview

CVE-2026-45639 is an out-of-bounds read vulnerability [CWE-125] in the Windows Remote Desktop Protocol (RDP). An unauthenticated remote attacker can exploit the flaw to read memory contents outside the intended buffer boundary. Successful exploitation discloses sensitive information over the network without user interaction.

The vulnerability carries a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation with no privileges required. The flaw impacts confidentiality only; integrity and availability remain unaffected. Microsoft published the advisory on June 9, 2026.

Critical Impact
An unauthenticated remote attacker can read out-of-bounds memory from a Windows RDP service and exfiltrate sensitive process data over the network.

Affected Products

Microsoft Windows (Remote Desktop Protocol service)
Refer to the Microsoft CVE-2026-45639 Advisory for the complete list of affected Windows builds
Systems exposing TCP port 3389 to untrusted networks

Discovery Timeline

2026-06-09 - CVE CVE-2026-45639 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45639

Vulnerability Analysis

The vulnerability resides in how the Windows RDP service parses protocol messages. The service reads beyond the bounds of an allocated buffer when processing crafted input from a remote client. This out-of-bounds read returns adjacent memory contents to the attacker through the RDP protocol response path.

The attack requires no authentication and no user interaction at the target. An attacker only needs network reachability to the RDP listener, which typically binds to TCP port 3389. The flaw exposes confidentiality (C:H) without affecting integrity or availability, indicating an information disclosure primitive rather than memory corruption leading to code execution.

Disclosed memory may include session tokens, credentials cached in the RDP process, cryptographic material, or pointers useful for bypassing Address Space Layout Randomization (ASLR). Repeated exploitation can incrementally map memory layout and harvest sensitive data over time.

EPSS data places exploitation probability at 0.081% with a percentile of 23.82, indicating limited observed activity at publication.

Root Cause

The root cause is missing or incorrect bounds validation when the RDP service reads length-prefixed protocol fields. The handler trusts a size value supplied in the request and reads memory based on that value without verifying it against the actual buffer length. This pattern matches CWE-125: Out-of-bounds Read.

Attack Vector

The attack vector is fully network based. An attacker sends a crafted RDP request to a vulnerable Windows host exposing the Remote Desktop service. The server processes the malformed field, performs the over-read, and returns memory contents within the protocol response. No credentials, no prior session, and no user action are required.

No public proof-of-concept code is available. Refer to the Microsoft CVE-2026-45639 Advisory for technical details.

Detection Methods for CVE-2026-45639

Indicators of Compromise

Unusual volumes of inbound RDP traffic from a single source on TCP port 3389
Repeated malformed or short RDP connection requests that terminate before authentication
RDP sessions originating from non-corporate or geographically anomalous IP addresses
Termsrv.exe or related RDP service processes generating unusual error or warning events

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational for repeated pre-authentication connection failures
Apply network IDS signatures that flag RDP packets with malformed length fields or oversized protocol structures
Correlate RDP scan and probe activity against threat intelligence indicators using a SIEM
Behavioral analytics platforms such as Singularity Endpoint and Singularity Data Lake can surface anomalous RDP service activity and aggregate it for triage

Monitoring Recommendations

Baseline normal RDP source addresses and alert on deviations
Track outbound data volumes from RDP-listening hosts to detect staged exfiltration
Enable verbose RDP protocol logging on internet-exposed hosts during patch rollout
Forward RDP-related telemetry into a centralized data lake for retrospective hunting

How to Mitigate CVE-2026-45639

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-45639 Advisory to all affected Windows systems
Restrict RDP exposure on the public internet and place RDP behind a VPN or zero-trust gateway
Enforce Network Level Authentication (NLA) on all RDP endpoints to add a pre-handshake authentication requirement
Inventory all hosts listening on TCP port 3389 and prioritize patching for externally reachable systems

Patch Information

Microsoft has issued a security update for CVE-2026-45639. Administrators should consult the Microsoft CVE-2026-45639 Advisory for affected build numbers and the corresponding cumulative updates. Apply the patch through Windows Update, WSUS, or your enterprise patch management platform.

Workarounds

Disable the Remote Desktop service on hosts that do not require it via Set-Service -Name TermService -StartupType Disabled
Block inbound TCP port 3389 at the perimeter firewall and internal segmentation points
Require RDP access only through a hardened jump host or bastion with multi-factor authentication
Limit RDP source addresses using Windows Firewall scoped rules until patches are deployed

bash

# Block inbound RDP at the host firewall as a temporary workaround
netsh advfirewall firewall add rule name="Block RDP Inbound" dir=in action=block protocol=TCP localport=3389