CVE-2026-61924 is a medium severity (CVSS 6.5) out-of-bounds read in the Remote Desktop Client for Windows. An unauthenticated remote attacker can disclose information when a user takes an action. Microsoft published the entry on 11 August 2026, so check its update guide for the fix for your build.
What's affected
The record lists these Windows releases as affected: Windows 10 1607, 1809, 21H2 and 22H2, and Windows 11 23H2, 24H2, 25H2 and 26H1. The weaknesses are CWE-125 (out-of-bounds read) and CWE-200 (exposure of sensitive information).
The CVSS vector is network based with low complexity, needs no privileges, and requires user interaction. Confidentiality impact is high, integrity and availability are unaffected. In plain terms, the client is the target, not the remote host, and a user has to take an action such as opening a connection.
The record gives no fixed build numbers. Microsoft's update guide entry for the CVE id is the place to find the KB article for each Windows version. This CVE has a sibling in the same component, a second out-of-bounds read with the same score, so check both entries together.
How to check if you're exposed
Check that the monthly cumulative update is installed on each Windows device that uses the Remote Desktop Client.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
[System.Environment]::OSVersion.Version
Compare the installed update with the KB number Microsoft lists for your Windows version in its update guide. Also note any machine that runs an older or separately packaged Remote Desktop client, since the record only names the Windows releases above.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Open the Microsoft update guide entry for the CVE id and note the KB number for each Windows version you run.
- Deploy the Microsoft updates listed for each version through your normal patch tooling, starting with laptops and admin workstations that connect to external hosts.
- Tell users to connect only to Remote Desktop hosts they recognise, and to treat connection files from email or chat with suspicion. The vector requires user interaction.
- Confirm completion with a patch report and keep a list of devices that could not be updated.
- Review your outbound RDP policy. Many organisations block direct RDP to the internet; that also limits where a client can be pointed.
Why it matters
An out-of-bounds read happens when code reads past the end of a buffer. Here the result is information disclosure, which can leak memory contents from the client process. Leaked memory is rarely the final goal; it can help defeat protections that rely on addresses being unknown, which is why read bugs in widely deployed clients still get patched promptly.
The weakness classes are CWE-125 and CWE-200. The record does not mark this CVE as exploited in the wild and it is not marked as a CISA Known Exploited Vulnerability. Treat it as routine but real patch work.
Quick check
Does this affect the Remote Desktop server or the client?
The record names the Remote Desktop Client. The vector needs user interaction, so the exposed machine is the one running the client.
Sources
Last reviewed: 18 October 2026.
