CVE-2026-45639Patch(microsoft / remote_desktop_client)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch microsoft remote_desktop_client systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Out-of-bounds read in Windows RDP allows an unauthorized attacker to disclose information over a network.

microsoft CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45639

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

remote_desktop_client
windows_10_1607
windows_10_1809
windows_10_21h2

Threat summary

Patch or workaround signal is available
10 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 6 signals
Technical details provided in 8 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 5 mentions (2026-06-10); latest day: 1
10 total mentions across 5 days

Affected systems

Vendors

microsoft

Products

remote_desktop_clientwindows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_app

2 versions affected across 15 products

Deep dive

Activity timeline10 mentions / 5d

Signal classification3 categories

Patch

550.0%

Disclosure

330.0%

General

220.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	1	Patch1
2026-06-10	5	Disclosure1General1Patch3
2026-06-11	1	Disclosure1
2026-06-13	2	Disclosure1General1
2026-06-17	1	Patch1

Full discourse10 posts

Cyber Security News@The_Cyber_News136d
Disclosure
⚠️ Windows RDP Vulnerabilities Allow Attacker to Expose Sensitive Data Source: https://cybersecuritynews.com/windows-remote-desktop-protocol-vulnerabilities/ Windows systems are impacted by two new Remote Desktop Protocol (RDP) information disclosure vulnerabilities, CVE-2026-42908 and CVE-2026-45639. Both issues were resolved in Microsoft’s security updates released on June 9, 2026. Both flaws stem from out-of-bounds reads in the RDP stack and are rated Important, with a CVSS v3 base score of 7.5. Microsoft describes CVE-2026-42908 and CVE-2026-45639 as information disclosure vulnerabilities in Windows Remote Desktop Protocol caused by an out-of-bounds read condition. An unauthenticated attacker can exploit these bugs remotely over the network without any user interaction. #cybersecuritynews
Post summary
Two new Windows RDP information‑disclosure CVEs were announced and patched by Microsoft on June 9 2026; the flaws involve out‑of‑bounds reads (CVSS 7.5) but no active exploitation or PoC has been reported.
8523185559.4K
69.7K followersView on X
elhacker.NET@elhackernet136d
Patch
Vulnerabilidades de RDP de Windows permiten exponer datos sensibles Microsoft ha solucionado dos nuevas vulnerabilidades de divulgación de información en el Protocolo de Escritorio Remoto (RDP) de Windows CVE-2026-42908 CVE-2026-45639 https://blog.elhacker.net/2026/06/vulnerabilidades-de-rdp-de-windows.html
Post summary
Microsoft has released fixes for CVE-2026-42908 and CVE-2026-45639, which are information‑disclosure flaws in Windows RDP.
116150204.4K
141.0K followersView on X
iototsecnews@iototsecnews129d
Patch
Microsoft RDP の脆弱性 CVE-2026-42908／45639：機密データ漏洩の恐れ https://iototsecnews.jp/2026/06/10/windows-rdp-vulnerabilities-allow-attacker-to-expose-sensitive-data/ 脆弱性 CVE-2026-42908／CVE-2026-45639 の原因は、Windows の RDP スタックにおける境界外読み取りにあります。本来アクセスしてはならない、バッファの範囲外のデータを読み取ってしまうことで、メモリ内に保持されている情報が漏洩する可能性があります。漏洩した情報に含まれる、メモリアドレス／認証情報／セッション・トークンなどは、他の脆弱性との連鎖を試行する攻撃者にとって、きわめて価値の高い情報となります。また、認証前の状態でネットワーク経由から到達可能であることも、リスクを高める要因です。Microsoft は修正プログラムを提供しているため、影響を受ける Windows 環境でも速やかなアップデート適用が重要となります。ご利用のチームは、ご注意ください。 #CVE202642908 #Microsoft #RDP #RemoteDesktopProtocol #Vulnerability
Post summary
Microsoft warns of two RDP stack vulnerabilities that can leak sensitive data before authentication and confirms that patches are available, urging rapid updates.
00000163
499 followersView on X
cybersecuritypath@cybrsecpath133d
Disclosure
CVE-2026-45639: Windows RDP Flaw Exposes Process Memory https://thecybrdef.com/cve-2026-45639-windows-rdp-flaw-exposes-process-memory/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post announces the release of CVE-2026-45639, highlighting it as a Windows RDP flaw that exposes process memory, but does not provide a PoC, exploit code, active exploitation evidence, patch info, or a debunking comment.
0000024
9 followersView on X
cybersecuritypath@cybrsecpath133d
General
CVE-2026-45639: Windows RDP Flaw Exposes Process Memory https://thecybrdef.com/cve-2026-45639-windows-rdp-flaw-exposes-process-memory/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
The post announces CVE‑2026‑45639, a Windows RDP flaw that exposes process memory, but it provides only a high‑level description without details on exploits, patches, or active use.
0000026
9 followersView on X
cybersecuritypath@cybrsecpath135d
Disclosure
CVE-2026-45639: Windows RDP Flaw Exposes Process Memory https://thecybrdef.com/cve-2026-45639-windows-rdp-flaw-exposes-process-memory/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post announces a new Windows RDP vulnerability (CVE‑2026‑45639) that can expose process memory, but offers no PoC, exploit, or patch details.
0000045
9 followersView on X
Crypto Master💎 Arichain@Vijaykiran0987136d
General
CVE-2026-45639: Windows RDP Flaw Exposes Process Memory https://thecybrdef.com/cve-2026-45639-windows-rdp-flaw-exposes-process-memory/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post only provides the CVE identifier, a headline stating a Windows RDP flaw, and a link, with no further technical or exploit details.
0000036
64 followersView on X
sea-are-pea@seaarepea136d
Patch
Microsoft’s security updates released June 9, 2026 patches out-of-bounds reads in the RDP stack of CVE-2026-42908 and CVE-2026-45639 #ITSecurity
Post summary
Microsoft released patches on June 9 2026 to fix out-of-bounds read vulnerabilities in RDP for CVE-2026-42908 and CVE-2026-45639.
0000038
74 followersView on X
Israel@f1tym1136d
Patch
Windows RDP Vulnerabilities Allow Attacker to Expose Sensitive Data https://ift.tt/PVbiIUh Windows systems are impacted by two new Remote Desktop Protocol (RDP) information disclosure vulnerabilities, CVE-2026-42908 and CVE-2026-45639. Both issues were resolved in Microsoft’s…
Post summary
The article reports that Microsoft has fixed two new Windows RDP information disclosure CVEs (CVE-2026-42908 and CVE-2026-45639), with no evidence of PoC or active exploitation.
0000031
993 followersView on X
WindowsForum@windowsforum137d
Patch
🪟 CVE-2026-45639: “not BlueKeep panic” but it’s unauthenticated, remote, and reads memory. Translation: RDP is still the vending machine for chaos. Patch today, breathe later. #Windows #Microsoft #RDP #CVE #Cybersecurity https://windowsforum.com/threads/cve-2026-45639-rdp-info-disclosure-confirmed-memory-read-patch-guidance.424292/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #PatchManagement #InfoDisclosure https://t.co/pWj3qw8O2a
Post summary
The post announces CVE-2026-45639 as a remote, unauthenticated RDP memory‑read vulnerability and urges users to apply the patch, but does not provide PoC, exploit code, or evidence of active exploitation.
0000044
1.2K followersView on X

CPE platform detail26 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

26 of 26 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	remote_desktop_client	-	windows	-
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
App	microsoft	windows_app	-	windows	-
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	x64
OS	microsoft	windows_server_2019	-	-	x64
OS	microsoft	windows_server_2022	-	-	x64
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs remote_desktop_client vulnerabilities

What researchers are saying

CVE-2026-45639

Cyber Security News[verified]@The_Cyber_NewsDisclosure

Two new Windows RDP information‑disclosure CVEs were announced and patched by Microsoft on June 9 2026; the flaws involve out‑of‑bounds reads (CVSS 7.5) but no active exploitation or PoC has been reported.

sea-are-pea[verified]@seaarepeaPatch

Microsoft released patches on June 9 2026 to fix out-of-bounds read vulnerabilities in RDP for CVE-2026-42908 and CVE-2026-45639.

Israel[verified]@f1tym1Patch

The article reports that Microsoft has fixed two new Windows RDP information disclosure CVEs (CVE-2026-42908 and CVE-2026-45639), with no evidence of PoC or active exploitation.

WindowsForum[verified]@windowsforumPatch

The post announces CVE-2026-45639 as a remote, unauthenticated RDP memory‑read vulnerability and urges users to apply the patch, but does not provide PoC, exploit code, or evidence of active exploitation.

elhacker.NET@elhackernetPatch

Microsoft has released fixes for CVE-2026-42908 and CVE-2026-45639, which are information‑disclosure flaws in Windows RDP.

iototsecnews@iototsecnewsPatch

Microsoft warns of two RDP stack vulnerabilities that can leak sensitive data before authentication and confirms that patches are available, urging rapid updates.

cybersecuritypath@cybrsecpathDisclosure

The post announces the release of CVE-2026-45639, highlighting it as a Windows RDP flaw that exposes process memory, but does not provide a PoC, exploit code, active exploitation evidence, patch info, or a debunking comment.

cybersecuritypath@cybrsecpathGeneral

The post announces CVE‑2026‑45639, a Windows RDP flaw that exposes process memory, but it provides only a high‑level description without details on exploits, patches, or active use.