CVE-2026-45639

CVE-2026-45639 is an information disclosure vulnerability affecting the Windows Remote Desktop Protocol (RDP). This flaw stems from an out-of-bounds read condition within the RDP stack. An unauthenticated attacker can exploit this vulnerability remotely over the network without user interaction to read portions of process memory. Successful exploitation could potentially leak sensitive data such as credentials, session tokens, or protocol state data, depending on the contents of the targeted memory region. This vulnerability impacts a wide range of Windows client and server releases where RDP is available, including various versions of Windows 10, Windows 11, and Windows Server. Microsoft addressed CVE-2026-45639 as part of its security updates released on June 9, 2026.