Windows RDP Memory-Disclosure Vulnerabilities (CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, CVE-2026-57979) — July 2026 Patch Tuesday — Threadlinqs Intelligence
As of 2026-07-15, Windows RDP Memory-Disclosure Vulnerabilities (CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, CVE-2026-57979) — July 2026 Patch Tuesday is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-1370 · Severity: MEDIUM · CVSS: 6.5 · Status: PATCHED · Category: VULNERABILITY
Microsoft's July 14, 2026 Patch Tuesday fixed five Important-rated (CVSS 6.5) information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP) stack caused by buffer over-reads,
On July 14, 2026, as part of the largest Patch Tuesday release on record (569-621 CVEs across the ecosystem depending on tracker), Microsoft disclosed and patched five related but distinct information-disclosure vulnerabilities in the server-side Windows Remote Desktop Protocol implementation: CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979. All five share an 'Important' severity rating, a CVSS 3.1 base score of 6.5 (temporal 5.7), a network attack vector, low attack complexity, and a High confidentiality / None integrity / None availability impact triad — meaning exploitation discloses data but does not modify state or cause denial of service.
The five CVEs cluster into two root-cause families. CVE-2026-50445 and CVE-2026-57979 are classic memory-safety over-reads: CVE-2026-50445 is a buffer over-read (CWE-126) in which the RDP protocol parser reads past an allocated buffer boundary and leaks adjacent heap memory to the remote peer; CVE-2026-57979 is an out-of-bounds read (CWE-125) with the same effect via a different code path in RDP session/channel data handling. CVE-2026-57982, CVE-2026-55003, and CVE-2026-50497 instead stem from failure to zero or initialize memory before it is used and transmitted: CVE-2026-57982 and CVE-2026-55003 are both 'Use of Uninitialized Resource' (CWE-908) findings, while CVE-2026-50497 is a compound off-by-one (CWE-193) plus uninitialized-resource (CWE-908) defect, where a boundary miscalculation causes one extra byte (or block) of stale heap content to be copied into an outbound RDP PDU.
Attack requirements differ slightly by CVE. CVE-2026-50445, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979 require no privileges (PR:N) but do require user interaction (UI:R) — the realistic scenario is a victim connecting to (or accepting a connection from) an attacker-controlled or attacker-manipulated RDP endpoint, e.g. a malicious RDP server the victim is lured into connecting to, or a machine-in-the-middle position that tampers with a legitimate RDP session. CVE-2026-57982 instead requires low privileges (PR:L) but no user interaction (UI:N), consistent with a scenario where a low-privileged authenticated session on the RDP host itself (or an already-established RDP session) is abused to read uninitialized server-side memory without further victim action.
Across all five, the practical impact is remote-memory disclosure: leaked heap contents can include in-memory credentials, session tokens/cookies, cryptographic key material, or pointers useful for defeating ASLR as a precursor to a follow-on exploit chain (the vulnerabilities themselves grant no code execution or privilege escalation). Microsoft's exploitability index rates all five 'Exploitation Unlikely' (some public trackers phrase this as 'less likely'), reflecting that reliable exploitation of a heap-layout-dependent info leak over the network is nontrivial to weaponize repeatably. No CVE in this set is CISA KEV-listed and no public proof-of-concept exploit code or evidence of in-the-wild exploitation had surfaced as of the July 14, 2026 disclosure and at time of this research — this negative finding was checked directly against CISA's KEV catalog feed and public exploit-code trackers cited in references.
The affected-version footprint is broad, spanning the full currently supported Windows client and server lifecycle: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through Windows Server 2025 (including 2012 R2, 2016, 2019, 2022, and Server Core installations where applicable), across 32-bit, x64, and ARM64 builds. Microsoft published fixed cumulative-update builds for each affected branch (e.g., Windows 10 1607/Server 2016 to build 14393.9339; Windows 10 1809/Server 2019 to 17763.9020; Windows 10 21H2 to 19044.7548; Windows 10 22H2 to 19045.7548; Windows 11 24H2/Server 2025 to 26100.8875; Windows 11 25H2 to 26200.8875; Windows 11 26H1 to 28000.2269) delivered v
Weaknesses (CWE)
CWE-126, CWE-908, CWE-193, CWE-125
Target sectors: government administration, finance, health, technology, education, manufacturing, professional-services, critical-infrastructure
Target regions: North America, Europe, Asia Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, CVE-2026-57979, T1595, T1590, T1190, T1133, T1203, T1212, T1539, T1552.006, T1082, T1046