Description

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T17:18:14.587Z",
  "pubdate": "2026-08-11T17:18:14.587Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Remote Desktop Client, potentially allowing an unauthorized network-based attacker to execute information disclosure attacks.\nThe vulnerability affects the Remote Desktop Client product, enabling threat actors to extract sensitive memory contents over the network without requiring authentication or prior privileges.\nThe primary risk implication involves the unauthorized leakage of internal memory structures, which could expose critical system secrets, cryptographic keys, or user data to malicious entities.\nAttack capabilities are restricted to information disclosure; however, the lack of authentication requirements significantly lowers the barrier to exploitation across network vectors.\nSuccessful exploitation requires the vulnerable Remote Desktop Client to process maliciously crafted responses or packets from a remote source, triggering the out-of-bounds read condition within the parsing logic.",
  "technicalDetails": "The root cause of the vulnerability stems from improper bounds checking within the Remote Desktop Client when parsing incoming data packets over the network.\nThe vulnerable component handles data decoding within the Remote Desktop Client protocol implementation, failing to adequately validate length fields against the actual allocated buffer size.\nAn unauthorized attacker positioned on the network can exploit this flaw by transmitting specially crafted packets designed to deceive the parsing engine into reading memory addresses outside the designated buffer boundary.\nThe attack flow proceeds as follows: first, the attacker establishes a network connection or intercepts existing sessions where the Remote Desktop Client processes data; second, the attacker transmits a crafted payload with manipulated length parameters; third, the client application reads past the intended buffer allocation during the decoding phase; finally, the out-of-bounds data is inadvertently returned or processed, enabling the leakage of adjacent heap or stack memory contents.\nThe vulnerability requires no authentication and can be triggered remotely over the network with zero privileges, granting external entities access to arbitrary memory segments depending on the internal layout.\nPost-exploitation impact is strictly localized to information disclosure, though the leaked memory contents may be leveraged by attackers to facilitate subsequent exploitation phases, such as bypassing address space layout randomization or recovering sensitive session tokens."
}