CVE-2026-58535: Windows RDP Information Disclosure Flaw

CVE-2026-58535 Overview

CVE-2026-58535 is an information disclosure vulnerability in the Microsoft Windows Remote Desktop Protocol (RDP). The flaw stems from the use of an uninitialized resource [CWE-908], which allows an unauthorized attacker to read memory contents over the network. Successful exploitation requires user interaction, typically by convincing a victim to connect to an attacker-controlled RDP endpoint. The disclosed data may contain sensitive information from process memory that can support follow-on attacks. Microsoft documented the flaw in the Microsoft Security Update CVE-2026-58535 advisory.

Critical Impact
An unauthorized network-based attacker can trigger disclosure of uninitialized memory contents from a Windows RDP component, exposing sensitive data that may aid subsequent intrusion stages.

Affected Products

Microsoft Windows (RDP component) — specific builds listed in the Microsoft Security Response Center advisory
Windows Server editions supporting Remote Desktop Services
Windows client SKUs providing Remote Desktop Connection functionality

Discovery Timeline

2026-07-14 - CVE-2026-58535 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58535

Vulnerability Analysis

The vulnerability is classified under [CWE-908]: Use of Uninitialized Resource. A component in the Windows RDP implementation allocates or references a resource without fully initializing its backing memory. When the resource is subsequently transmitted or processed, residual data from prior allocations is exposed to the connected peer.

The attack vector is network-based and requires user interaction, aligning with a scenario where a user is induced to initiate an RDP session with an attacker-controlled server. The confidentiality impact is high, while integrity and availability are not affected. This pattern is consistent with a server-to-client information leak triggered during RDP session negotiation or data channel exchange.

Because the disclosed memory is uninitialized, its contents are non-deterministic. Repeated connections can allow an attacker to accumulate memory fragments, potentially exposing credentials, session tokens, cryptographic material, or pointers useful for bypassing address space layout randomization.

Root Cause

The root cause is a code path in the RDP stack that reads from a buffer or object field before that memory has been written with a defined value. Standard secure coding practice requires zero-initializing buffers before serialization onto the wire, and the affected component fails to enforce this invariant.

Attack Vector

An attacker hosts a malicious RDP endpoint and lures a victim into connecting through phishing, a crafted .rdp file, or a link that invokes the Remote Desktop client. During protocol negotiation, the malicious server elicits responses or observes fields populated with uninitialized data. See the Microsoft Security Update CVE-2026-58535 for authoritative technical details.

Detection Methods for CVE-2026-58535

Indicators of Compromise

Outbound RDP (TCP/UDP 3389) connections from user endpoints to untrusted or newly registered external hosts
Execution of mstsc.exe spawned from email clients, browsers, or archive utilities
Downloaded or opened .rdp files originating from untrusted sources or attachments
Anomalous DNS resolutions preceding RDP client launches to non-corporate destinations

Detection Strategies

Alert on mstsc.exe process creation where the parent process is outlook.exe, a browser, or an archive tool such as 7zg.exe or explorer.exe acting on a downloaded file
Correlate .rdp file writes in user Downloads or temp directories with subsequent outbound RDP connections
Baseline expected RDP destinations per user and flag connections to addresses outside that baseline

Monitoring Recommendations

Ingest endpoint process telemetry and network flow logs into a centralized analytics platform for RDP connection auditing
Monitor Windows Event ID 4624 logon type 10 patterns and outbound connection logs from Sysmon Event ID 3
Track patch deployment status for the Windows RDP update associated with CVE-2026-58535 across the fleet

How to Mitigate CVE-2026-58535

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-58535 advisory to all affected Windows systems
Block outbound RDP (TCP/UDP 3389) from user workstations to the internet at the perimeter firewall
Educate users to avoid opening .rdp files or clicking rdp:// links from untrusted sources

Patch Information

Microsoft has released a security update addressing CVE-2026-58535. Refer to the Microsoft Security Update CVE-2026-58535 advisory for the list of affected builds and corresponding KB article numbers. Deploy the update through Windows Update, WSUS, or your patch management platform.

Workarounds

Restrict outbound RDP connections at the network boundary and permit only vetted destinations
Configure Group Policy to block execution of .rdp files from mail clients and browsers via attachment manager or SmartScreen
Require RDP connections to traverse a Remote Desktop Gateway with strict destination allowlists

bash

# Configuration example: block outbound RDP at the Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound RDP" `
    -Direction Outbound `
    -Protocol TCP `
    -RemotePort 3389 `
    -Action Block `
    -Profile Any