CVE-2026-58539: Windows 10 1607 Information Disclosure

CVE-2026-58539 Overview

CVE-2026-58539 is an out-of-bounds read vulnerability [CWE-125] affecting the Windows Remote Desktop Protocol (RDP) implementation across supported Microsoft Windows client and server editions. The flaw allows an unauthenticated remote attacker to read memory contents outside the intended buffer boundary, resulting in information disclosure over the network. Microsoft published the advisory on July 14, 2026, and the issue impacts a broad range of Windows 10, Windows 11, and Windows Server releases. No authentication or user interaction is required to reach the vulnerable code path, which increases the risk for internet-exposed RDP endpoints.

Critical Impact
An unauthorized network attacker can send crafted RDP traffic to a vulnerable host and disclose confidential memory contents without any credentials or user interaction.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-58539 published to the National Vulnerability Database
2026-07-14 - Microsoft publishes the Security Update Guide entry for CVE-2026-58539
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-58539

Vulnerability Analysis

The vulnerability resides in the Windows Remote Desktop Protocol service, which listens on TCP port 3389 by default. An out-of-bounds read [CWE-125] occurs when the RDP handler processes attacker-controlled protocol data and accesses memory beyond the bounds of an allocated buffer. The read operation returns memory contents that the attacker can retrieve through the RDP session, exposing sensitive data such as session state, cryptographic material, or adjacent heap contents. Because the flaw affects confidentiality only, exploitation does not corrupt process memory or grant code execution on its own. However, the leaked data may be combined with other vulnerabilities to enable broader compromise.

Root Cause

The root cause is missing or insufficient bounds validation within the RDP parsing logic. When the service processes a malformed request field, it computes a read length or offset from attacker-supplied values without verifying the value against the actual buffer size. This allows the service to read past the end of the intended buffer.

Attack Vector

Exploitation requires network access to a system running the Remote Desktop service. The attacker sends specially crafted RDP messages during protocol negotiation or session handling to trigger the out-of-bounds read. The response returned by the server includes the leaked memory contents, which the attacker parses locally. No credentials or user interaction on the target are required.

No public proof-of-concept exploit code has been released for CVE-2026-58539 at the time of writing. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-58539

Indicators of Compromise

Anomalous inbound TCP connections to port 3389 from unexpected external IP addresses, particularly short-lived sessions that terminate before completing authentication.
Repeated malformed RDP handshake packets or unusual protocol negotiation sequences captured in network telemetry.
Unexplained crashes, exceptions, or restarts of the TermService (Remote Desktop Services) process in Windows event logs.

Detection Strategies

Deploy network intrusion detection signatures that inspect RDP protocol conformance and flag oversized or malformed X.224 and MCS packets during the connection setup phase.
Correlate RDP connection attempts with authentication outcomes to identify sessions that repeatedly disconnect before reaching credential validation.
Baseline normal RDP traffic patterns per host and alert on deviations in packet size distribution or negotiation flow.

Monitoring Recommendations

Ingest Windows Security and TerminalServices-RemoteConnectionManager event logs into a central SIEM for correlation across the fleet.
Monitor exposure of TCP/3389 to untrusted networks using external attack surface management tooling and remediate any unexpected internet-facing hosts.
Track EPSS movement for CVE-2026-58539 (currently 0.868%) as an early indicator of increasing exploit interest.

How to Mitigate CVE-2026-58539

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory all systems with the Remote Desktop role enabled and prioritize patching for internet-exposed hosts and jump servers first.
Restrict inbound TCP/3389 at perimeter firewalls to known administrative source ranges or require access through a VPN or Zero Trust broker.

Patch Information

Microsoft has released security updates addressing CVE-2026-58539 across all supported Windows client and server versions listed in the affected products. Consult the Microsoft Security Update Guide for the specific KB article and build number corresponding to each Windows release.

Workarounds

Disable the Remote Desktop service on systems that do not require it by setting the TermService startup type to Disabled.
Enforce Network Level Authentication (NLA) on all remaining RDP hosts to require authentication before full protocol parsing occurs.
Front RDP with a Remote Desktop Gateway or Zero Trust Network Access solution to eliminate direct exposure of the vulnerable service.

bash

# Configuration example: disable RDP and block port 3389 via PowerShell
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 1
Stop-Service -Name TermService -Force
Set-Service -Name TermService -StartupType Disabled
New-NetFirewallRule -DisplayName 'Block RDP Inbound' -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block