An out‑of‑bounds read flaw in the Windows Remote Desktop Protocol stack enables an unauthenticated network attacker to read memory contents and disclose sensitive information, such as configuration data or private memory segments, without requiring privileges. The vulnerability arises from improper bounds checking when processing RDP packets and is classified as CWE‑125. The impact is a potential compromise of confidentiality, with attackers able to capture secrets transmitted over the network.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; and the Microsoft Windows App Client for Windows Desktop.

The CVSS score of 7.5 indicates a high severity for information disclosure. EPSS data is not available, so the current exploit probability is unknown, but the vulnerability is present in widely deployed RDP implementations and requires only remote access to port 3389. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation at the time of analysis. An attacker could trigger the out‑of‑bounds read by sending crafted RDP packets over an unauthenticated connection, thereby leaking data, but no code execution or privilege escalation is possible.