OTPulse

Windows Remote Desktop Client Information Disclosure Vulnerability

MonitorCVSS 6.5CVE-2026-50504Jul 14, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

A buffer over-read vulnerability in Windows Remote Desktop Client allows an unauthorized attacker to disclose sensitive information over the network. The vulnerability is triggered when a user connects to a malicious Remote Desktop server, allowing the server to read unintended regions of the client's memory and extract data such as credentials or cached information.

What this means
What could happen
An attacker could trick a user into connecting to a malicious Remote Desktop server, causing the Remote Desktop Client to read and disclose sensitive information from the user's system memory. This could expose credentials, process data, or other confidential information.
Who's at risk
System administrators and end users running Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), or Windows Server (2016, 2019, 2022, 2025) who use Remote Desktop to connect to other systems or allow RDP connections for remote support.
How it could be exploited
An attacker sets up a malicious RDP server and tricks or socially engineers a user into connecting to it from an affected Windows system. When the user's Remote Desktop Client connects, the vulnerability in the client allows the server to read unintended memory regions and extract sensitive data during the connection.
Prerequisites
  • User must be tricked into connecting to an attacker-controlled Remote Desktop server
  • Remote Desktop Client must be present on the system
  • User interaction required (initiating the RDP connection)
user interaction required (reduces risk)remotely exploitablelow complexityEPSS 0.6% (low probability)
Exploitability
Unlikely to be exploited — EPSS score 0.9%
Affected products (23)
23 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9020
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9020
Windows Server 2019All versionsBuild 10.0.17763.9020
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9020
Windows Server 2022All versionsBuild 10.0.20348.5386
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft's July 2026 security update or later to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
View full vendor advisory
API: /api/v1/advisories/43e60a1f-a3c2-422c-bb66-dc7e97b9a61e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Remote Desktop Client Information Disclosure Vulnerability | CVSS 6.5 - OTPulse