CVE-2019-1108

CVE-2019-1108 is an information disclosure vulnerability affecting the Windows RDP client across various Windows operating systems and server versions. This flaw allows an attacker to improperly disclose the contents of the client's memory. With a CVSS score of 6.5 (Medium), it can be exploited over the network with low privileges and no user interaction, potentially leading to high confidentiality impact. While not listed in CISA's KEV catalog, its EPSS score and community discussion indicate notable interest. There is no public exploit code available in Metasploit, Nuclei, or ExploitDB, and media coverage primarily focuses on Microsoft's broader patch releases rather than specific active exploitation of this CVE.