# CVE-2016-0190: Remote Desktop Protocol Drive Redirection Information Disclosure Vulnerability CVE-2016-0190 is fixed in 4 products on 1 platform, first by KB3155784, released May 10, 2016. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2016-0190 - Priority: High - CVSS: n/a (Important) - EPSS: 0.0234 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Vendor exploitability assessment: N/A - Published: May 10, 2016 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2016-0190 ## Description

An information disclosure vulnerability exists in Microsoft Windows when a USB disk mounted over Remote Desktop Protocol (RDP) via Microsoft RemoteFX is not correctly tied to the session of the mounting user.

An attacker who successfully exploited this vulnerability could obtain access to file and directory information on the mounting user’s USB disk.

This update addresses the vulnerability by ensuring that access to USB disks over RDP is correctly enforced to prevent non-mounting session access.

## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Windows Server 2012 | | [KB3155784](https://patchblox.com/security/data/fix/microsoft/kb3155784.md) | May 10, 2016 | | Microsoft | Windows Server 2012 (Server Core installation) | | [KB3155784](https://patchblox.com/security/data/fix/microsoft/kb3155784.md) | May 10, 2016 | | Microsoft | Windows Server 2012 R2 | | [KB3155784](https://patchblox.com/security/data/fix/microsoft/kb3155784.md) | May 10, 2016 | | Microsoft | Windows Server 2012 R2 (Server Core installation) | | [KB3155784](https://patchblox.com/security/data/fix/microsoft/kb3155784.md) | May 10, 2016 | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo