CVE-2019-1225

Remote Desktop Protocol Server Information Disclosure Vulnerability

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. Fixed in publication.

CVSS 3.17.5High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixpublicationUpgrade to this build

Published 2019-08-14Updated 2026-02-20Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 1803Affected: ≥ 10.0.0, < publicationUpgrade to: publicationStated by: CVE record
Microsoft Windows Server, version 1803Affected: ≥ 10.0.0, < publicationUpgrade to: publicationStated by: CVE record
Microsoft Windows Server 2019Affected: ≥ 10.0.0, < publicationUpgrade to: publicationStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Windows computers or servers have Remote Desktop enabled and can be reached from untrusted networks.
Install the Microsoft security update for CVE-2019-1225 through Windows Update; Microsoft lists affected supported releases as fixed in the publication update rather than a single version number.
Until updates are complete, restrict Remote Desktop access to a VPN or named trusted addresses and disable it on systems that do not need it.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An information disclosure vulnerability exists when the Windows RDP server improperly discloses the contents of its memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the system. To exploit this vulnerability, an attacker would have to connect remotely to an affected system and run a specially crafted application. The security update addresses the vulnerability by correcting how the Windows RDP server initializes memory.

In plain language

Written by AI from the record

This affects Windows computers and servers with Remote Desktop enabled; install Microsoft’s security update to prevent an outsider from reading sensitive information from the machine.

Remote memory disclosure in the Windows RDP server allows an unauthenticated network attacker to retrieve improperly initialized memory by connecting remotely and running a crafted application.

If you're affected

Sensitive data exposure
Account information theft
Follow-on system compromise
Business service disruption

What is it

A flaw in Windows Remote Desktop can accidentally reveal information left in a computer’s working memory to someone connecting from afar. It is like a receptionist handing a visitor scraps of paperwork from behind the desk—those scraps may help the visitor gain access to more important areas.

Who is affected

This matters to you if you use or run Windows computers or servers with Remote Desktop enabled. It is only a risk where an attacker can remotely connect to the affected system.

How urgent is it

An attacker can attempt this remotely, and the predicted likelihood of exploitation is rising, so treat this as an amber-priority update. There is no confirmed active exploitation and no public exploit code on record, but internet-exposed Remote Desktop systems should be addressed promptly.

What to do — in detail

Confirm exposure by identifying Windows endpoints and servers with the Remote Desktop service enabled, then determine whether they accept connections from untrusted networks. Apply Microsoft’s security update published for CVE-2019-1225 through the normal Windows servicing channel; the vendor identifies Windows 10, Windows Server, and Windows Server 2019 as fixed in the publication update, with no single replacement version specified in the findings.

No application migration or breaking-change note is identified. If patching must be delayed, disable Remote Desktop where it is unnecessary; where it is required, limit access through a VPN or explicitly approved source addresses. Review Remote Desktop connection and authentication logs for unusual external connection attempts until remediation is verified. CISA has not added this CVE to KEV, so there is no CISA due date.

Technical context

CVSS 3.1 is 7.5 (High): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. CWE-200 information disclosure results from improper Windows RDP server memory initialization; a remote attacker connects to an affected system and executes a specially crafted application to retrieve memory contents. No CISA KEV listing, confirmed in-the-wild exploitation, or public exploit code is recorded. EPSS is 10.5% at the 96th percentile and rising; this is predictive, not confirmation of exploitation. Press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 2593 days, from the signal feeds we watch.

2026-09-19EPSS band change0 → moderateepss band change
2026-06-25OpenVAS check added
2026-02-20Patch availablerecord updated
2019-08-14Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

And 17 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact