This vulnerability (CVE-2026-54126) involves an out-of-bounds read (CWE-125) in the Windows RDP service on Windows 10 Version 1607 (build 10.0.14393.0). An attacker without privileges can remotely trigger this flaw to read memory beyond intended boundaries, potentially disclosing sensitive information over the network. The vulnerability does not allow code execution or denial of service but impacts confidentiality. Microsoft has published an official fix to address this issue.

An attacker can exploit this vulnerability remotely without authentication to read memory outside of intended buffers in the RDP service. This leads to unauthorized disclosure of information, impacting confidentiality (high impact on confidentiality). There is no impact on integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54126 to remediate this vulnerability.