This vulnerability (CWE-125) involves an out-of-bounds read in the Windows Remote Desktop Protocol (RDP) client, which could be exploited by an unauthenticated attacker to disclose sensitive information remotely. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. Microsoft has published an official fix for this vulnerability, as detailed in their security advisory.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of information from the affected Remote Desktop client, potentially exposing sensitive data to attackers over the network. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

An official patch is available from Microsoft to remediate this vulnerability. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45639 to mitigate the risk. No additional mitigation steps are indicated by the vendor.