CVE-2026-57979 Overview
CVE-2026-57979 is an out-of-bounds read vulnerability in the Windows Remote Desktop Protocol (RDP) implementation. The flaw allows an unauthenticated attacker to disclose memory contents over the network by sending crafted RDP traffic to an affected system. No user interaction or prior authentication is required to trigger the condition.
Microsoft published the advisory on 2026-07-14, and it affects a broad range of Windows client and server releases, including Windows Server 2012 through 2025 and Windows 10 and 11. The weakness is classified as CWE-125 (Out-of-bounds Read).
Critical Impact
An unauthenticated remote attacker can read out-of-bounds memory from the RDP service, potentially leaking sensitive process memory that assists further attacks.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-57979 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-57979
Vulnerability Analysis
The vulnerability resides in the Windows RDP service, which handles remote session connections over TCP port 3389 by default. An out-of-bounds read occurs when the service parses attacker-controlled protocol data without properly validating buffer boundaries. As a result, the RDP service reads memory beyond an allocated buffer and returns portions of that memory in protocol responses or internal state.
The issue impacts confidentiality only. It does not corrupt memory or grant code execution on its own. Disclosed memory can contain session artifacts, cryptographic material, or pointers useful for defeating address space layout randomization (ASLR) in follow-on exploitation.
Because RDP is often exposed to the internet or across trust boundaries, this flaw is attractive for reconnaissance chained with other Windows vulnerabilities. The EPSS probability sits at 0.666%, reflecting a low but non-trivial likelihood of near-term exploitation activity.
Root Cause
The root cause is missing or incorrect bounds validation in a message parsing routine within the RDP stack. When the service processes a specially crafted PDU (Protocol Data Unit), it reads past the end of the intended buffer. This pattern maps to [CWE-125], where the length field or offset used during parsing is trusted without verification against the actual buffer size.
Attack Vector
Exploitation requires only network access to an exposed RDP listener. The attacker connects to the target, negotiates the RDP session at the appropriate protocol layer, and sends a malformed message that triggers the out-of-bounds read. The service then returns memory content or otherwise exposes it through observable behavior. No credentials, tokens, or user interaction are needed. See the Microsoft CVE-2026-57979 Advisory for vendor-specific details.
Detection Methods for CVE-2026-57979
Indicators of Compromise
- Unexpected inbound connections to TCP port 3389 from untrusted sources or geographies not aligned with normal administrative activity.
- Anomalous volumes of short-lived RDP sessions that terminate before authentication completes.
- RDP service crashes, unexpected restarts of TermService, or entries in the System event log referencing the RDP stack.
Detection Strategies
- Inspect network telemetry for repeated pre-authentication RDP handshakes originating from a single source, which can indicate memory disclosure probing.
- Correlate RDP protocol anomalies with process memory events on the target host to identify scanning campaigns.
- Apply IDS/IPS signatures that flag malformed RDP PDUs and oversized length fields in early session negotiation.
Monitoring Recommendations
- Monitor svchost.exe instances hosting the Remote Desktop Services group for unusual read patterns and instability.
- Alert on any external exposure of TCP 3389 discovered through attack surface scans.
- Track Windows Event IDs related to Terminal Services and RDP-Tcp listener errors for spikes consistent with probing.
How to Mitigate CVE-2026-57979
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-57979 Advisory to all affected Windows client and server systems.
- Restrict RDP exposure at the network perimeter by blocking inbound TCP 3389 from the internet and limiting access to jump hosts or VPN-authenticated ranges.
- Enable Network Level Authentication (NLA) on all RDP-enabled hosts to reduce pre-authentication attack surface.
Patch Information
Microsoft has issued security updates covering all listed products, from Windows Server 2012 through Windows Server 2025 and Windows 10 and 11. Administrators should deploy the corresponding cumulative update through Windows Update, WSUS, or their preferred patch management tool. Verify installation by checking the KB number listed in the vendor advisory against wmic qfe list output.
Workarounds
- Disable Remote Desktop on systems that do not require it by setting fDenyTSConnections to 1 in the registry.
- Place RDP endpoints behind a Remote Desktop Gateway or Zero Trust Network Access broker that enforces identity before protocol exposure.
- Enforce firewall rules that restrict RDP to specific administrative source IP ranges.
# Configuration example: disable RDP and block inbound 3389 via PowerShell
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
New-NetFirewallRule -DisplayName 'Block Inbound RDP' -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
