Remote Desktop Display Driver Information Disclosure Vulnerability
MonitorCVSS 5.5CVE-2026-96321Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
An out-of-bounds read vulnerability in the Remote Desktop Display Driver allows an authorized local user to disclose information by reading unintended memory areas. The vulnerability affects Windows 10 Version 21H2 and 22H2 (32-bit, ARM64, x64), Windows 11 versions 23H2 through 26H1 (ARM64, x64), Windows Server 2022, and Windows Server 2025. Microsoft has released fixes in the October 2026 security update.
What this means
What could happen
An authorized user on a Windows machine could read memory from the Remote Desktop Display Driver to obtain sensitive information that is not intended to be accessible.
Who's at risk
This affects Windows 10 (all versions including 21H2 and 22H2) on 32-bit, ARM64, and x64 platforms; Windows 11 (all versions from 23H2 through 26H1) on ARM64 and x64 platforms; and Windows Server 2022 and Windows Server 2025 installations. Any organization running these Windows versions should apply the patch during scheduled maintenance windows.
How it could be exploited
An attacker with a local user account logs into a Windows 10, Windows 11, or Windows Server system and triggers an out-of-bounds read in the Remote Desktop Display Driver component to access memory contents beyond the intended boundaries.
Prerequisites
- Local user account on the affected Windows system
- Remote Desktop Display Driver installed or enabled
requires local user account
Exploitability
Unlikely to be exploited - EPSS score 0.4%
Affected products (20)
20 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule - requires maintenance window
0/1Patching may require device reboot, plan for process interruption
HOTFIXApply the 2026 October security update to Windows 10, Windows 11, or Windows Server systems
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/e60700fa-031b-41ea-b18d-958fdc02895dGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.