This vulnerability (CVE-2026-50504) involves a buffer over-read in the Remote Desktop Client on Microsoft Windows 10 Version 1607 (build 10.0.14393.0). The flaw enables an attacker without privileges and requiring user interaction to cause information disclosure remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact, and an official fix is available. Microsoft has published an advisory with an official fix to address this issue.

Successful exploitation of this vulnerability could allow an unauthorized attacker to disclose sensitive information over the network. There is no impact on system integrity or availability. The attack requires user interaction but no privileges, and can be performed remotely.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50504 to remediate this vulnerability.