SB20261110353 - Multiple vulnerabilities in Microsoft Windows
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-108417)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from heap memory.
The vulnerability exists due to an out-of-bounds read in Remote Desktop Client when handling a connection to an attacker-controlled server. A remote attacker can convince a user to connect an affected client application to that server to potentially read portions of the client's heap memory.
2) Out-of-bounds read (CVE-ID: CVE-2026-108418)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from portions of heap memory.
The vulnerability exists due to an out-of-bounds read in Remote Desktop Client when communicating with an attacker-controlled server. A remote attacker can convince a user to connect an affected client application to that server to potentially read portions of the client's heap memory.
3) Out-of-bounds read (CVE-ID: CVE-2026-108419)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information from the affected client's heap memory.
The vulnerability exists due to an out-of-bounds read in Windows Remote Desktop Client when handling a connection to an attacker-controlled server. A remote attacker can convince a user to connect an affected client application to that server to potentially read portions of heap memory.
Remediation
Install update from vendor's website.