The vulnerability is a heap-based buffer overflow in the Windows Remote Desktop service that permits an attacker with local authorization to gain elevated privileges. This type of overflow can corrupt memory and override security boundaries, enabling the attacker to execute code or perform actions normally restricted to higher privilege levels.

Affected products are Microsoft Windows operating systems and servers, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 23H2, and 2025, across both client and server core installations.

The CVSS score of 7.8 indicates a high impact, but the lack of an available EPSS score suggests no publicly known exploitation trend. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker must be able to run code locally on the affected system, implying the attack vector is local or requires prior compromise. The exploit could elevate a standard user to full administrator rights, allowing arbitrary code execution and potential lateral movement within the network.