Microsoft Fixes Multiple Windows RDP Flaws Exposing Sensitive Data Over the Network

Microsoft has addressed multiple information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP). This widely used service enables remote administration and access to Windows systems.

The five flaws could permit attackers to retrieve information from vulnerable hosts, potentially exposing data held in application memory during an RDP session.

Microsoft Fixes Multiple Windows RDP Flaws

All vulnerabilities were assigned an Important severity rating and a CVSS v3.1 base score of 6.56.56.5. Microsoft’s advisory data indicates that most of the flaws can be reached remotely without authentication, although successful exploitation requires user interaction. The exception is CVE-2026-57982, which requires low-privileged local access but does not require user interaction.

• CVE-2026-50445: Windows RDP information disclosure flaw caused by a buffer over-read (CWE-126), potentially exposing sensitive data over a network.
• CVE-2026-50497: RDP information disclosure vulnerability involving an off-by-one error and uninitialized resource use (CWE-193, CWE-908).
• CVE-2026-55003: An uninitialized resource issue in Windows RDP (CWE-908) that could leak sensitive memory-resident information.
• CVE-2026-57979: Windows RDP out-of-bounds read vulnerability (CWE-125) that could allow unauthorized information disclosure over the network.
• CVE-2026-57982: An RDP information disclosure flaw caused by uninitialized resource use (CWE-908); it requires low privileges but no user interaction.

CVE-2026-50445 is caused by a buffer over-read condition, classified as CWE-126. Such issues occur when software reads beyond the intended boundary of a memory buffer, potentially returning adjacent data that should not be exposed.

An attacker could exploit the weakness by causing the affected RDP component to process specially crafted data, resulting in disclosure of sensitive information over the network.

The second issue, CVE-2026-50497, involves an off-by-one error and use of an uninitialized resource, mapped to CWE-193 and CWE-908. Off-by-one flaws can cause software to access one byte or element beyond a valid memory boundary.

At the same time, uninitialized-resource issues may expose residual data from memory that has not been properly initialized before use.

Microsoft also fixed CVE-2026-55003 and CVE-2026-57982, both stemming from the use of uninitialized resources. These bugs may enable disclosure of data left in memory by other processes or prior operations.

CVE-2026-57979, meanwhile, is an out-of-bounds read vulnerability, classified as CWE-125, which can similarly allow unauthorized reading of memory beyond the permitted region.

The network-reachable vulnerabilities, CVE-2026-50445, CVE-2026-50497, CVE-2026-55003, and CVE-2026-57979, carry the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

This means exploitation has low complexity and requires no prior privileges, but an attacker must convince a user to interact with malicious content or a crafted RDP connection scenario. The impact is limited to confidentiality, with no direct effects on integrity or availability stated in the CVSS vectors.

Organizations should apply Microsoft’s July 2026 security updates promptly, especially on endpoints, jump servers, and infrastructure systems where RDP is enabled.

Administrators should also restrict RDP exposure to the public internet, require VPN or zero-trust access controls, enable Network Level Authentication, enforce multi-factor authentication, and monitor RDP logs for suspicious connections or session behavior.

Gain browser-level visibility to expose decrypted phishing pages, speed investigations, and cut credential theft costs -> Power your SOC with ANY.RUN