A use-after-free flaw exists in the Remote Desktop Client that allows an attacker with network connectivity to execute arbitrary code on the target system. The vulnerability occurs when memory that has already been freed is accessed, enabling the attacker to control privileged execution paths. This flaw can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability.

Affected installations include Microsoft Windows 10 releases from version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2, Windows Server 2012 (both core and standard), Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Both 32‑bit and 64‑bit, as well as ARM64 variants, are impacted.

The CVSS score of 8.8 denotes high severity. Although the EPSS score is not available, the lack of a KEV listing suggests the vulnerability has not been widely leveraged yet, yet the remote code execution nature warrants immediate attention. An attacker would need to establish a Remote Desktop session or transmit malicious data over the network to trigger the flaw, which can be accomplished from beyond the local host.