CVE-2026-42908

CVE-2026-42908 is an information disclosure vulnerability impacting the Windows Remote Desktop Protocol (RDP). This flaw stems from an out-of-bounds read condition within the RDP stack. An unauthenticated attacker can exploit this vulnerability remotely over a network without requiring any user interaction. Successful exploitation of CVE-2026-42908 can lead to the exposure of sensitive memory contents. This type of information disclosure can weaken modern exploit mitigations, such as Address Space Layout Randomization (ASLR), potentially making other vulnerabilities easier to exploit. Microsoft addressed this issue in its security updates released on June 9, 2026.