Windows Remote Desktop Client Information Disclosure Vulnerability

MonitorCVSS 6.5CVE-2026-61921Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Out-of-bounds read in Windows Remote Desktop Client allows an unauthorized attacker to disclose information over a network. An attacker can send specially crafted RDP packets to trigger a memory read error and leak sensitive data from the client. The Remote Desktop Client on Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 are affected.

What this means
What could happen
An attacker could craft a malicious RDP connection to trigger an out-of-bounds read, potentially exposing sensitive information from memory on a user's workstation or server. This affects any staff using Remote Desktop to access systems, but the attacker cannot alter data or operations—only read it.
Who's at risk
Any organization using Windows 10 (versions 1607, 1809, 21H2, 22H2) or Windows 11 (versions 23H2, 24H2, 25H2, 26H1) as administrative or engineering workstations, as well as Windows Server 2016, 2019, 2022, and 2025 systems that staff use to manage OT equipment via Remote Desktop. This includes water authorities and electric utilities with SCADA engineering teams or control center operators who remote in to PLCs, historians, or gateway systems.
How it could be exploited
An attacker creates a malicious Remote Desktop server or intercepts an RDP connection, sending specially crafted packets that trigger a memory read error in the client. When a user connects to the attacker's or compromised RDP server, the client leaks memory contents that may contain credentials, encryption keys, or other sensitive data.
Prerequisites
  • User must initiate a Remote Desktop connection to an attacker-controlled or compromised RDP server
  • Attacker must be able to respond to RDP connection attempts with malicious packets
  • No special credentials or configuration required on the target system
remotely exploitableno authentication requiredlow complexityaffects workstations used to manage critical infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/3
Do now
0/2
HARDENINGRestrict Remote Desktop access to only trusted RDP servers using firewall rules or network segmentation
WORKAROUNDDisable Remote Desktop on systems that do not require it, or use RDP-restricting Group Policies to limit who can initiate connections
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply the 2026-Aug Windows security update to all Windows 10, Windows 11, and Windows Server systems in your network
API: /api/v1/advisories/67f8c893-e704-40d7-a53e-8ed9926a0a73

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows Remote Desktop Client Information Disclosure Vulnerability | CVSS 6.5 - OTPulse