Critical Windows RDP Vulnerabilities Expose Sensitive Data

Key Takeaways

• Microsoft has released patches for two critical information disclosure vulnerabilities in Windows Remote Desktop Protocol (RDP).
• The flaws, CVE-2026-42908 and CVE-2026-45639, affect a wide range of Windows client and server operating systems, including Windows 10, Windows 11, and various Windows Server versions, as well as the Remote Desktop client.
• Rated with a CVSS v3 base score of 7.5 (Important), these vulnerabilities allow unauthenticated, remote attackers to read sensitive memory contents without user interaction.
• Although currently assessed as “Less Likely” to be exploited, these bugs can be chained with other vulnerabilities to facilitate more severe attacks like remote code execution or sandbox escapes.
• Immediate application of the June 9, 2026 security updates is strongly recommended to mitigate these risks.

Windows RDP Flaws Expose Sensitive System Data

Microsoft has recently addressed two significant information disclosure vulnerabilities within its Remote Desktop Protocol (RDP) that impact a broad spectrum of Windows systems. These issues, identified as CVE-2026-42908 and CVE-2026-45639, were resolved as part of the company’s scheduled security updates released on June 9, 2026.

Both vulnerabilities stem from out-of-bounds read conditions within the RDP stack, a critical component for remote access. They are classified as “Important” severity, each carrying a CVSS v3 base score of 7.5, reflecting their potential impact despite being “only” information disclosure flaws.

Technical Details and Potential Impact

According to Microsoft’s advisories, both CVE-2026-42908 and CVE-2026-45639 are information disclosure vulnerabilities. Exploitation is possible remotely and pre-authentication, meaning an attacker does not need to be authenticated to the system or require any user interaction. This is reflected in their CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, highlighting the high confidentiality impact.

While these vulnerabilities themselves do not directly lead to remote code execution or system compromise, they expose sensitive memory contents. Such information can be crucial for attackers to bypass modern security mitigations like Address Space Layout Randomization (ASLR), gather credentials, session tokens, or other protocol state data. This makes them valuable components in multi-stage attack chains, potentially enabling more severe outcomes such as remote code execution or sandbox escapes when combined with other vulnerabilities.

Specifically, successful exploitation of CVE-2026-42908 can reveal local memory addresses, significantly weakening exploit mitigations. For CVE-2026-45639, an attacker could read portions of process memory, potentially leaking critical data depending on the memory region targeted.

Microsoft currently assesses the likelihood of exploitation as “Less Likely,” and there is no public exploit code or evidence of in-the-wild abuse reported at the time of the patch release.

Affected Systems and Remediation

The vulnerabilities affect a broad range of Windows client and server releases where RDP is enabled. This includes:

• Windows 10 (versions 21H2, 22H2, 1607, 1809)
• Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
• Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
• The Remote Desktop client/Windows App client for Windows Desktop

Both CVEs are categorized under CWE-125, an “Out-of-bounds Read” condition. This indicates that the vulnerable RDP component attempts to read data beyond the allocated buffer, inadvertently returning data from adjacent memory regions when processing specially crafted RDP traffic.

The pre-authentication and network-reachable nature of these flaws raise particular concern for RDP endpoints exposed to the internet and in multi-tenant environments, where cross-tenant information leakage could occur.

Microsoft has provided official fixes for all impacted products as part of its June 9, 2026 Patch Tuesday rollout. The recommended remediation is to apply these security updates or the relevant cumulative/rollup packages for each affected Windows version and RDP client build.

What You Should Do

• Apply Patches Immediately: Prioritize the installation of the June 9, 2026 security updates or relevant cumulative/rollup packages for all affected Windows client and server systems.
• Prioritize Internet-Facing RDP: Systems with RDP exposed directly to the internet should be patched first due to the pre-authentication, remote exploitability.
• Restrict RDP Access: Implement network-level restrictions for RDP, such as placing it behind a Virtual Private Network (VPN) or bastion hosts, to limit direct exposure.
• Enforce Strong Authentication: Utilize multi-factor authentication (MFA) for RDP access to add an extra layer of security.
• Monitor RDP Activity: Continuously monitor RDP connection logs for unusual patterns, failed login attempts, or connections from unexpected source IPs.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.