CVE-2026-69550

mediumpriority · track · 0EPSS 0.009 · 60 %ileUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.92% (60th) EPSS

CVSS 6.5 · medium

Is it mine?

3 products

Check your exposure

Who says so?

2 sources

msrc_csaf · nvd

EPSS · scored 2026-10-28

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedWindows App for Macmsrc_csaf
11.3.9:Security Update:https://go.microsoft.com/fwlink/?linkid=868963
https://go.microsoft.com/fwlink/?linkid=868963

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · secure@microsoft.com USexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nsecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-126USprimaryCWE-125USCWE-125USCWE-126USCWE-126US

affected products (3)

Products and version ranges known to be affected.

Microsoft Windows App for Macall versionsfixedmsrc_csafUS
Microsoft Windows App for Mac< 11.3.9msrc_csafUS
microsoft windows app< 11.3.9nvdUScpe:2.3:a:microsoft:windows_app:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

msrc_CVE-2026-69550Windows App for Mac Information Disclosure Vulnerability2026-08-11csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

sources

Which sources assert this record, and when.

msrc_csaf nvd NVD CVE.org MITRE

published 2026-08-19modified 2026-08-27

related (735)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2017-7679US	critical9.8	39.3% (99th)	Exploit	2017-06-20
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
CVE-2023-49285US	high7.5	88.1% (100th)	—	2023-12-04
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Messag…
CVE-2017-7668US	high7.5	57.5% (99th)	—	2017-06-20
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input str…
CVE-2021-20093US	critical9.1	33.3% (98th)	—	2021-06-16
A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. An unauthenticated remote attacker can exploit this issue to disclose heap memory contents or cr…
CVE-2023-36397US	critical9.8	17.5% (97th)	—	2023-11-14
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

+730 more

references (1) nvd

External citations — patches, advisories, analysis.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69550PatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan