---
id: "CVE-2026-121677"
page: "https://infrastack.ai/live/CVE-2026-121677"
kind: "vulnerability"
aliases: ["CVE-2026-121677"]
title: "Windows Remote Desktop Client: out-of-bounds read can leak memory over network"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Remote Desktop Client", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["infrastructure", "remote-desktop", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:31+00:00"
first_seen_at: "2026-11-10T19:25:09+00:00"
updated_at: "2026-11-10T19:56:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121677", "first_seen_at": "2026-11-10T19:25:09+00:00"}]
exploit_sources: []
---

# Windows Remote Desktop Client: out-of-bounds read can leak memory over network

Link for people: https://infrastack.ai/live/CVE-2026-121677 (this .md is for agents)

A bounds-checking flaw in the Remote Desktop Client lets an unauthorized attacker read memory outside the intended buffer over the network. The sources say the attacker can disclose information, but not that they can run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Remote Desktop Client affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T19:25:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121677

## From the sources

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_