CVE-2026-61918: Windows 10 1607 Information Disclosure Flaw

CVE-2026-61918 Overview

CVE-2026-61918 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Remote Desktop Client. The flaw allows an unauthenticated attacker to disclose sensitive information over a network without user interaction. The vulnerability affects a broad range of Windows client and server platforms, including Windows 10, Windows 11, and Windows Server 2012 through 2025. Microsoft published the advisory on August 11, 2026 and last updated it on August 13, 2026.

Critical Impact
An unauthenticated remote attacker can read out-of-bounds memory from the Remote Desktop Client, leading to disclosure of process memory that may contain credentials, session data, or other sensitive information.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61918 published to the National Vulnerability Database
2026-08-11 - Microsoft publishes security update guidance for CVE-2026-61918
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61918

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within the Microsoft Remote Desktop Client. When the client processes data received from a remote endpoint, it reads memory beyond the intended buffer boundary. The resulting disclosure exposes adjacent process memory back to the attacker over the network.

Exploitation requires no authentication and no user interaction beyond initiating or accepting a Remote Desktop Protocol (RDP) connection to an attacker-controlled server. The impact is limited to confidentiality: the vector permits information disclosure but not modification or denial of service. Attackers commonly weaponize such primitives to leak stack cookies, heap addresses, or credentials to bypass Address Space Layout Randomization (ASLR) and stage follow-on attacks.

Root Cause

The root cause is missing or insufficient bounds validation on a length or offset field within an RDP message parsed by the client. When the client reads a structured message from the server, the parser dereferences a pointer past the end of the allocated buffer. This behavior maps directly to the CWE-125 pattern of reading memory outside the bounds of a valid buffer.

Attack Vector

The attack vector is network-based. An attacker hosts a malicious RDP server and induces a target user or automated service to connect. Once the client parses attacker-controlled protocol data, the out-of-bounds read triggers and disclosed memory is returned to the attacker within subsequent protocol exchanges. Public exploit code has not been observed, and the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. See the Microsoft Security Update CVE-2026-61918 advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-61918

Indicators of Compromise

Outbound RDP connections (TCP/3389 or UDP/3389) from workstations or servers to untrusted or newly observed external IP addresses
mstsc.exe process launches followed by connections to non-corporate destinations
Unusual crash telemetry or Windows Error Reporting entries referencing the Remote Desktop Client modules

Detection Strategies

Hunt for RDP client sessions initiated to external destinations outside of sanctioned jump host or bastion ranges
Correlate mstsc.exe execution with subsequent network flows to non-approved IPs and geolocations
Alert on RDP client processes making connections without a corresponding user-initiated shortcut or .rdp file launch, which may indicate scripted or coerced connections

Monitoring Recommendations

Enable Windows Sysmon event logging for process creation and network connection events to capture mstsc.exe activity
Forward Windows Event Log channels for RDP client activity (Microsoft-Windows-TerminalServices-ClientActiveXCore/Operational) to a central SIEM
Baseline expected outbound RDP destinations per business unit and alert on deviations

How to Mitigate CVE-2026-61918

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-61918 advisory to all affected Windows client and server systems
Block outbound TCP/3389 and UDP/3389 at perimeter firewalls except to explicitly approved destinations
Restrict use of the Remote Desktop Client to trusted internal jump hosts and bastion servers
Educate users to avoid launching .rdp files delivered through email or web downloads

Patch Information

Microsoft has released security updates addressing CVE-2026-61918 across all supported Windows versions listed in the advisory. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or another patch management pipeline. Consult the Microsoft Security Update CVE-2026-61918 page for the specific Knowledge Base article and package for each affected build.

Workarounds

Enforce egress firewall rules that block RDP client traffic to untrusted networks until patches are deployed
Require users to connect only through a controlled Remote Desktop Gateway that validates destination servers
Disable or remove the Remote Desktop Client on endpoints that do not require it via Group Policy or application control

bash

# Configuration example: block outbound RDP to untrusted destinations via Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound RDP (CVE-2026-61918)" `
    -Direction Outbound `
    -Protocol TCP `
    -RemotePort 3389 `
    -Action Block `
    -Profile Any

New-NetFirewallRule -DisplayName "Block Outbound RDP UDP (CVE-2026-61918)" `
    -Direction Outbound `
    -Protocol UDP `
    -RemotePort 3389 `
    -Action Block `
    -Profile Any