Out-of-bounds read in Microsoft .NET Framework - CVE-2026-121678
Published: November 11, 2026
Vulnerability identifier: #VU165442
CSH Severity: Medium
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121678
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information from small portions of heap memory.
The vulnerability exists due to an out-of-bounds read in Remote Desktop Client when processing network data. A remote attacker can supply crafted network data that, with user interaction, causes the client to read beyond memory boundaries and disclose portions of heap memory.
Affected software
Microsoft .NET Framework
How to mitigate CVE-2026-121678
Install security update from vendor's website.
Microsoft .NET Framework - update to 2.0.1489.0