The vulnerability is a use‑after‑free flaw in the Remote Desktop Gateway Service that permits an attacker who can connect over the network to execute arbitrary code. The core weakness is identified as CWE‑416, which indicates that the service can be tricked into operating on freed memory, allowing code injection. Successful exploitation would give the attacker full control of the target system, exposing all sensitive data and allowing complete takeover of the host.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H2; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in their standard editions; and Microsoft Windows Server 2012 Server Core, 2012 R2 Server Core, 2016 Server Core, 2019 Server Core, 2025 Server Core installations.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation at the time of analysis. The likely attack vector is remote access through the Remote Desktop Gateway Service over a network connection. An attacker would need network reachability to the affected endpoint and the ability to send crafted RDP traffic to trigger the use‑after‑free condition.