CVE-2026-61921: Windows 10 1607 Information Disclosure Flaw

CVE-2026-61921 Overview

CVE-2026-61921 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Remote Desktop Client. The flaw allows an unauthorized attacker to disclose information over a network when a user connects to a malicious or compromised Remote Desktop Protocol (RDP) server. Exploitation requires user interaction, typically convincing the victim to initiate an RDP session with an attacker-controlled endpoint. The vulnerability affects a broad range of supported Windows client and server operating systems, from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025.

Critical Impact
Successful exploitation exposes sensitive process memory from the Remote Desktop Client, potentially leaking credentials, session tokens, or other information useful for follow-on attacks.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-61921 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-61921

Vulnerability Analysis

The vulnerability resides in how the Microsoft Remote Desktop Client parses data received from a remote RDP server. The client reads beyond the bounds of an allocated buffer while processing attacker-controlled protocol data. This out-of-bounds read returns adjacent process memory to the attacker-controlled server. Disclosed memory may contain fragments of credentials, cryptographic material, session state, or pointer values useful for bypassing address space layout randomization (ASLR). Confidentiality is impacted; integrity and availability are not affected by this specific flaw.

Root Cause

The root cause is classified under [CWE-125] Out-of-bounds Read. The client fails to validate that a length or offset field in an inbound RDP message stays within the allocated buffer before performing a memory read. When the field exceeds the buffer size, the client reads adjacent heap or stack memory and reflects that content back through the protocol channel.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker must operate or control an RDP server and induce a target user to connect, typically through a malicious .rdp file delivered by phishing, a manipulated shortcut, or a compromised jump host. Once the client establishes the session, the malicious server sends crafted protocol messages that trigger the out-of-bounds read. No authentication is required on the attacker side, and no privileges are needed on the target beyond the ability to launch the Remote Desktop Client.

No public proof-of-concept code or exploit modules have been released for CVE-2026-61921 at the time of publication. See the Microsoft Security Response Center advisory for authoritative technical details.

Detection Methods for CVE-2026-61921

Indicators of Compromise

Outbound RDP connections (TCP/3389 or UDP RDP transports) from user workstations to previously unseen or low-reputation external hosts
Execution of mstsc.exe spawned by email clients, browsers, or Office applications, indicating a delivered .rdp file was opened
.rdp files written to user download or temporary directories followed shortly by an RDP session initiation
Unexpected crashes or exception events tied to mstsc.exe or mstscax.dll in the Windows Application event log

Detection Strategies

Alert on process ancestry where mstsc.exe is launched by outlook.exe, winword.exe, chrome.exe, msedge.exe, or scripting hosts such as powershell.exe and wscript.exe
Correlate creation of *.rdp files in user-writable paths with immediate execution of the Remote Desktop Client
Baseline expected internal RDP destinations and flag connections leaving the corporate network boundary

Monitoring Recommendations

Ingest EDR process, file, and network telemetry into a centralized data lake and pivot on mstsc.exe activity
Monitor egress firewall logs for RDP traffic destined to internet ranges outside sanctioned admin bastions
Track patch deployment status across Windows client and server fleets against the Microsoft advisory for CVE-2026-61921

How to Mitigate CVE-2026-61921

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-61921 to all affected Windows client and server builds
Prioritize patching endpoints that regularly initiate outbound RDP sessions, particularly administrator and jump host workstations
Warn users against opening .rdp file attachments or links from untrusted sources

Patch Information

Microsoft has published a security update through the standard Update Guide for CVE-2026-61921. The advisory covers Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025). Administrators should validate that the corresponding cumulative update is installed on every affected SKU, including ARM64 variants.

Workarounds

Block outbound TCP/3389 and RDP UDP transports at the perimeter firewall except to explicitly approved destinations
Enforce Group Policy or Attack Surface Reduction rules that prevent Office and mail clients from launching mstsc.exe
Restrict RDP client usage to hardened administrative workstations and require connections to flow through an authenticated RDP gateway

bash

# Example: block outbound RDP to non-approved destinations on a Windows host
New-NetFirewallRule -DisplayName "Block Outbound RDP - CVE-2026-61921" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 3389 `
  -Action Block `
  -Profile Any