The vulnerability is an out‑of‑bounds read in Microsoft Windows Remote Desktop Client that permits an attacker to read memory contents and reveal confidential data. This flaw can be exploited without initial access to the target system, as it is triggered by data exchanged over an RDP session, and it only requires the ability to connect to the victim’s Remote Desktop endpoint.

Affected configurations include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations of 2012 and 2012 R2.

The CVSS score of 6.5 reflects moderate severity, and the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can leverage a simple RDP connection to trigger the read and discover sensitive information flowing across the network. Since the flaw resides in the client component, any machine that initiates or accepts Remote Desktop traffic is potentially vulnerable, but no privileges or credentials are required.