An off‑by‑one error in the Windows Remote Desktop Protocol enables an unauthorized attacker to read information transmitted over the network during an RDP session. The flaw is characterized by CWE‑193 and CWE‑908 and results in an information‑disclosure weakness without granting code execution or privilege escalation.

Affected systems include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 including Server Core installations.

The CVSS score of 6.5 indicates medium severity. The EPSS score of less than 1 % suggests a low likelihood of public exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to an RDP‑enabled service to exploit the off‑by‑one flaw and retrieve data; no privileged conditions are required. Because the disclosed data is transmitted over the network, the overall risk remains moderate for environments that regularly use RDP.