CVE-2026-70587

CVE-2026-70587 is an improper null termination flaw (CWE-170) in the Microsoft Windows Remote Desktop Protocol (RDP) implementation. A remote, unauthenticated attacker can trigger the flaw by sending crafted network input to a system's RDP listener, causing the service to mishandle string termination and leak information to the attacker. The impact is limited to confidential disclosure — there is no integrity or availability impact per the CVSS vector — but the flaw requires no privileges, no user interaction, and is easy to exploit (AV:N/AC:L/PR:N/UI:N). It affects Windows systems with the RDP service reachable over a network, which is most concerning for endpoints and servers with RDP exposed to the internet or shared networks. As of now there is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS assigns a 0.8% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for this CVE as soon as it is available, prioritizing systems where RDP is reachable from untrusted networks. In the meantime, inventory internet-facing RDP (TCP 3389), restrict access via firewall/VPN rules, and keep Network-Level Authentication enforced; monitor for published proof-of-concept code given the unauthenticated, network-reachable nature of the flaw.