An out‑of‑bounds read occurs in the Windows Remote Desktop Protocol stack, allowing an attacker who has established an authorized RDP session to read data from memory that should be inaccessible. This flaw can expose sensitive information such as files, credentials, or process memory, and is classified as CWE‑125, an out‑of‑bounds read weakness. The impact is partial disclosure of confidential data rather than system takeover.

Affected systems include multiple Microsoft Windows client and server releases: Windows 10 versions from 1607 through 22H2, Windows 11 versions from 23H2 through 26H2 (including arm64 and x64 builds), and Windows Server editions from 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both standard and Server Core). Preservation of the full list is recommended to ensure all impacted editions are patched.

The CVSS score of 5.3 reflects a moderate severity, and no EPSS score is available, indicating limited data on current exploitation prevalence. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to first gain RDP access to the target—either through legitimate credentials or pre‑existing authorization—and then exploit the read vulnerability during the session. Because the flaw is reachable only from an authorized RDP context, the risk is bounded to environments that expose RDP to internal or external networks.