CVE-2026-70587 Overview
CVE-2026-70587 is an information disclosure vulnerability in the Windows Remote Desktop Protocol (RDP). The flaw stems from improper null termination [CWE-170] within RDP message handling. An unauthenticated remote attacker can exploit the weakness over a network to disclose sensitive information from affected systems. No user interaction or prior privileges are required, and the attack complexity is low.
Microsoft published the advisory in the Microsoft Security Update Guide. The current EPSS probability is 0.787%, placing the vulnerability in the 54th percentile for exploitation likelihood.
Critical Impact
An unauthorized remote attacker can leak sensitive memory contents from Windows systems exposing RDP over the network, without authentication or user interaction.
Affected Products
- Microsoft Windows (Remote Desktop Protocol component)
- Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
- Any Windows host exposing RDP (typically TCP/3389)
Discovery Timeline
- 2026-09-08 - CVE-2026-70587 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-70587
Vulnerability Analysis
The vulnerability is classified as Improper Null Termination [CWE-170] within the Windows Remote Desktop Protocol. RDP processes structured messages that contain string or buffer fields expected to be null-terminated. When a field is not properly terminated, downstream string-handling routines read beyond the intended buffer boundary. That over-read returns adjacent memory contents to the caller, and in this case to the remote client across the network.
Because the impact is scoped to confidentiality, exploitation does not corrupt memory or execute code. Instead, attackers use crafted RDP traffic to harvest fragments of process memory, which may include session data, tokens, pointers, or other artifacts useful for follow-on attacks. Repeated queries can be used to leak information incrementally.
Root Cause
The root cause is a missing or incorrect null terminator on a string or buffer processed by the RDP service. String handling functions rely on the terminator to determine length. Without it, the routine continues reading adjacent memory until an unrelated null byte is encountered, exposing whatever data resides in that range.
Attack Vector
The attack vector is network-based against exposed RDP endpoints, typically TCP/3389. An unauthenticated attacker establishes a connection and sends crafted RDP protocol data that triggers the improperly terminated field handling. The server responds with data that includes over-read memory contents. See the Microsoft Security Update Guide for protocol-level technical details.
No verified public exploit code is available for CVE-2026-70587 at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-70587
Indicators of Compromise
- Anomalous inbound RDP sessions from unfamiliar or geographically improbable source IPs
- Unusually long-lived or repetitive RDP handshakes that do not progress to authenticated sessions
- Elevated volume of malformed RDP protocol data units against TermService
- Outbound RDP responses larger than expected for pre-authentication traffic
Detection Strategies
- Alert on unauthenticated RDP connections that generate response payloads exceeding baseline sizes for pre-auth traffic
- Deploy IDS/IPS signatures for malformed RDP PDUs targeting string fields lacking null termination
- Correlate RDP connection events (Event IDs 1149, 4624 type 10) with source reputation and rate
- Hunt for scanning patterns targeting TCP/3389 across the environment
Monitoring Recommendations
- Continuously monitor Windows Security and TerminalServices operational logs for anomalies
- Ingest network flow and packet metadata for RDP into a SIEM for rate and payload analysis
- Track exposure by identifying assets with TCP/3389 reachable from untrusted networks
- Baseline normal RDP client software versions and alert on non-standard clients
How to Mitigate CVE-2026-70587
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing allows
- Inventory all Windows hosts with RDP enabled and prioritize internet-exposed systems
- Restrict RDP access to trusted management networks via firewall rules or a VPN
- Enforce Network Level Authentication (NLA) to require authentication before RDP session establishment
Patch Information
Microsoft has published guidance and updates for CVE-2026-70587 through the Microsoft Security Update Guide. Administrators should consult the official advisory to identify the applicable KB article for each Windows version and deploy the update through Windows Update, WSUS, or Microsoft Update Catalog.
Workarounds
- Disable Remote Desktop on systems that do not require it via System Properties or Group Policy
- Block inbound TCP/3389 at the perimeter and require VPN or Remote Desktop Gateway for remote access
- Enforce Network Level Authentication to reduce pre-authentication attack surface
- Place RDP behind an authenticated jump host with MFA and session logging
# Configuration example: restrict RDP to a trusted management subnet on Windows
New-NetFirewallRule -DisplayName "Restrict RDP to Mgmt" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.10.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block RDP All Others" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block
# Enforce Network Level Authentication
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
