An out-of-bounds read flaw (CWE-125) in the Remote Desktop Gateway Service lets an authorized user read data from memory that lies beyond the boundaries of a buffer that the service processes. The read data can be returned across the network, providing the attacker with confidential information such as credentials, message contents, or configuration data that was not intended for external disclosure. This results in an information-disclosure vulnerability that compromises confidentiality.

The flaw affects Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and the upcoming 2025, including both full and Server Core installations, whenever the Remote Desktop Gateway Service is installed and operational.

The vulnerability scores a CVSS of 6.5, indicating moderate severity, and no EPSS data is available. The CVE is not listed in CISA’s KEV catalog, but it can be exploited by authenticated or authorized users that can reach the RDS Gateway over the network. Because the flaw requires the service to be running and does not rely on privileged escalation, the risk is limited to environments that expose or use the RDS Gateway, making patching and network restrictions the most effective mitigation.