Use after free in the Remote Desktop Client allows an unauthorized attacker to execute code over a network, providing full control over the affected system. The flaw, identified as a typical memory safety bug (CWE‑416), permits an attacker to run arbitrary code, compromising confidentiality, integrity, and availability of the target system.

The vulnerability affects multiple Windows client and server releases. Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed versions are affected; see the Microsoft update guide for the specific patches.

The CVSS score of 8.8 indicates a high severity flaw. The event probability (EPSS) is not available, and the vulnerability is not in the CISA KEV catalog. The likely attack vector involves a network‑based exploitation of the Remote Desktop protocol; an attacker who can initiate or intercept an RDP session may trigger the use‑after‑free to execute arbitrary code. Because the flaw resides in the client component, exploitation is possible even on machines where the server role is not present, making a wide range of systems vulnerable if they have Remote Desktop enabled.