Windows RDP Memory-Disclosure Vulnerabilities (CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, CVE-2026-57979) — July 2026 Patch Tuesday

Windows RDP Memory-Disclosure Vulnerabilities (TL-2026-1370), also tracked as July 2026 Patch Tuesday RDP Information Disclosure Cluster, is a medium-severity software vulnerability scored CVSS 6.5, first published 2026-07-15. It has no confirmed attribution, affects Microsoft Windows 10, references 5 CVEs (CVE-2026-50445, CVE-2026-57982, CVE-2026-55003), maps to 15 MITRE ATT&CK techniques (T1005, T1021, T1021.001), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1370

Threat ID
TL-2026-1370
Also known as
July 2026 Patch Tuesday RDP Information Disclosure Cluster
Severity
MEDIUM
CVSS
6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, manufacturing, professional-services, critical-infrastructure
Target regions
North America, Europe, Asia Pacific, Global
Detection rules
9
Indicators of compromise
16

Microsoft's July 14, 2026 Patch Tuesday fixed five Important-rated (CVSS 6.5) information-disclosure vulnerabilities in the Windows Remote Desktop Protocol (RDP) stack caused by buffer over-reads, out-of-bounds reads, an off-by-one error, and use of uninitialized resources. Successful exploitation lets a network-positioned attacker read process memory during an RDP session, potentially exposing credentials, session tokens, or ASLR-defeating pointers. Microsoft rates all five 'Exploitation Unlikely' and no public PoC or in-the-wild exploitation had been observed at disclosure.

How Windows RDP Memory-Disclosure Vulnerabilities works

On July 14, 2026, as part of the largest Patch Tuesday release on record (569-621 CVEs across the ecosystem depending on tracker), Microsoft disclosed and patched five related but distinct information-disclosure vulnerabilities in the server-side Windows Remote Desktop Protocol implementation: CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979. All five share an 'Important' severity rating, a CVSS 3.1 base score of 6.5 (temporal 5.7), a network attack vector, low attack complexity, and a High confidentiality / None integrity / None availability impact triad — meaning exploitation discloses data but does not modify state or cause denial of service.

The five CVEs cluster into two root-cause families. CVE-2026-50445 and CVE-2026-57979 are classic memory-safety over-reads: CVE-2026-50445 is a buffer over-read (CWE-126) in which the RDP protocol parser reads past an allocated buffer boundary and leaks adjacent heap memory to the remote peer; CVE-2026-57979 is an out-of-bounds read (CWE-125) with the same effect via a different code path in RDP session/channel data handling. CVE-2026-57982, CVE-2026-55003, and CVE-2026-50497 instead stem from failure to zero or initialize memory before it is used and transmitted: CVE-2026-57982 and CVE-2026-55003 are both 'Use of Uninitialized Resource' (CWE-908) findings, while CVE-2026-50497 is a compound off-by-one (CWE-193) plus uninitialized-resource (CWE-908) defect, where a boundary miscalculation causes one extra byte (or block) of stale heap content to be copied into an outbound RDP PDU.

Attack requirements differ slightly by CVE. CVE-2026-50445, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979 require no privileges (PR:N) but do require user interaction (UI:R) — the realistic scenario is a victim connecting to (or accepting a connection from) an attacker-controlled or attacker-manipulated RDP endpoint, e.g. a malicious RDP server the victim is lured into connecting to, or a machine-in-the-middle position that tampers with a legitimate RDP session. CVE-2026-57982 instead requires low privileges (PR:L) but no user interaction (UI:N), consistent with a scenario where a low-privileged authenticated session on the RDP host itself (or an already-established RDP session) is abused to read uninitialized server-side memory without further victim action.

Across all five, the practical impact is remote-memory disclosure: leaked heap contents can include in-memory credentials, session tokens/cookies, cryptographic key material, or pointers useful for defeating ASLR as a precursor to a follow-on exploit chain (the vulnerabilities themselves grant no code execution or privilege escalation). Microsoft's exploitability index rates all five 'Exploitation Unlikely' (some public trackers phrase this as 'less likely'), reflecting that reliable exploitation of a heap-layout-dependent info leak over the network is nontrivial to weaponize repeatably. No CVE in this set is CISA KEV-listed and no public proof-of-concept exploit code or evidence of in-the-wild exploitation had surfaced as of the July 14, 2026 disclosure and at time of this research — this negative finding was checked directly against CISA's KEV catalog feed and public exploit-code trackers cited in references.

The affected-version footprint is broad, spanning the full currently supported Windows client and server lifecycle: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through Windows Server 2025 (including 2012 R2, 2016, 2019, 2022, and Server Core installations where applicable), across 32-bit, x64, and ARM64 builds. Microsoft published fixed cumulative-update builds for each affected branch (e.g., Windows 10 1607/Server 2016 to build 14393.9339; Windows 10 1809/Server 2019 to 17763.9020; Windows 10 21H2 to 19044.7548; Windows 10 22H2 to 19045.7548; Windows 11 24H2/Server 2025 to 26100.8875; Windows 11 25H2 to 26200.8875; Windows 11 26H1 to 28000.2269) delivered via the standard July 2026 Patch Tuesday cumulative updates and the Microsoft Update Catalog. No documented workaround exists short of patching; Microsoft and third-party analysts recommend closing internet exposure of TCP/UDP 3389, fronting RDP with a VPN, Remote Desktop Gateway, or zero-trust proxy, enforcing Network Level Authentication (NLA), and prioritizing patch rollout to internet-facing hosts, administrative jump servers, and domain controllers.

This threat did not independently clear HUNT threat-selection thresholds (CVSS 6.5 sits below the 7.0 network-vector qualifying bar, exploitability is rated unlikely, there is no KEV listing, no public PoC, and no nation-state attribution or ransomware/supply-chain linkage) but is documented for RDP memory-disclosure exposure coverage given the size of the affected fleet and same-day patch availability.

MITRE ATT&CK techniques used in TL-2026-1370

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1021.001 Remote Desktop Protocol

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552.006 Group Policy Preferences

credential-access

T1557 Adversary-in-the-Middle

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

defense-impairment

T1686 Disable or Modify System Firewall

Affected products and versions in Windows RDP Memory-Disclosure Vulnerabilities

  • Microsoft — Windows 10
    Vulnerable versions: 1607; 1809; 21H2; 22H2
    Fixed in: 1607: 14393.9339; 1809: 17763.9020; 21H2: 19044.7548; 22H2: 19045.7548
  • Microsoft — Windows 11
    Vulnerable versions: 24H2; 25H2; 26H1
    Fixed in: 24H2: 26100.8875; 25H2: 26200.8875; 26H1: 28000.2269
  • Microsoft — Windows Server
    Vulnerable versions: 2012; 2012 R2; 2016; 2019; 2022; 2025
    Fixed in: 2016: 14393.9339; 2019: 17763.9020; 2025 (24H2 base): 26100.8875

Remediation for Windows RDP Memory-Disclosure Vulnerabilities

Patches

  • Windows 10 v1607 / Server 2016 -> build 14393.9339
  • Windows 10 v1809 / Server 2019 -> build 17763.9020
  • Windows 10 v21H2 -> build 19044.7548
  • Windows 10 v22H2 -> build 19045.7548
  • Windows 11 v24H2 / Server 2025 -> build 26100.8875
  • Windows 11 v25H2 -> build 26200.8875
  • Windows 11 v26H1 -> build 28000.2269

Immediate actions

  • Deploy the July 2026 cumulative security updates to all affected Windows 10, Windows 11, and Windows Server builds
  • Verify patch installation via installed build number rather than assuming Windows Update enablement equals remediation
  • Prioritize internet-facing RDP hosts, administrative jump servers, and domain controllers for accelerated patching

Workarounds

  • No documented workaround exists; closing TCP/UDP 3389 at the network perimeter and requiring VPN/gateway access reduces exposure but does not remediate the underlying flaw

Longer-term hardening

  • Front all RDP access with a VPN, Remote Desktop Gateway, or zero-trust network access proxy rather than exposing port 3389 directly
  • Enforce Network Level Authentication (NLA) on all RDP listeners
  • Disable Remote Desktop Services on hosts that do not require it
  • Monitor for anomalous or unexpected RDP connection attempts and unusual RDP session volumes
  • Restrict RDP firewall rules to approved management network ranges only

CVEs associated with Windows RDP Memory-Disclosure Vulnerabilities

CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, CVE-2026-57979

Weaknesses (CWE) in Windows RDP Memory-Disclosure Vulnerabilities

CWE-126, CWE-908, CWE-193, CWE-125

Timeline of Windows RDP Memory-Disclosure Vulnerabilities

  • CVE-2026-57982 (and related CVE identifiers in this cluster) reserved ahead of coordinated disclosure.
  • Community technical analysis (Windows Forum) notes Microsoft has not stated that Network Level Authentication (NLA) blocks exploitation of CVE-2026-50445, undercutting NLA as a standalone compensating control and reinforcing that patching is the only confirmed remediation.
  • CVE-2026-50445 published in the NVD with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N and CWE-126 (Buffer Over-read), matching Microsoft's MSRC scoring; equivalent NVD records published same-day for the other four CVEs in the cluster.
  • Cyber Security News, CyberPress, BleepingComputer, and Windows-focused outlets publish coverage summarizing the RDP information-disclosure cluster within the broader July 2026 Patch Tuesday roundup.
  • Microsoft's exploitability index rates all five CVEs 'Exploitation Unlikely'; no public proof-of-concept exploit code identified for any of the five at disclosure.
  • Fixed cumulative-update builds released for all affected Windows 10, Windows 11, and Windows Server branches via Windows Update and the Microsoft Update Catalog; no workaround published, only the patch remediates the flaws.
  • Microsoft publishes July 2026 Patch Tuesday, disclosing and patching CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979, five Important-rated RDP information-disclosure vulnerabilities, as part of the largest single Patch Tuesday release on record (569-621 total CVEs across trackers).
  • TL-Intel-Harness HUNT phase flags the cluster for RDP memory-disclosure exposure coverage despite not independently meeting primary threat-selection thresholds (CVSS below 7.0 network-vector bar, no KEV listing, no PoC, no attribution).
  • Cross-check against the CISA Known Exploited Vulnerabilities catalog confirms none of the five CVEs are KEV-listed as of this research date; no in-the-wild exploitation reported.

Sources cited for Windows RDP Memory-Disclosure Vulnerabilities

Threats related to Windows RDP Memory-Disclosure Vulnerabilities

Detection coverage for TL-2026-1370

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1370 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats