The vulnerability is a heap-based buffer overflow in the Microsoft Remote Desktop client. The overflow allows an attacker who can send crafted data over the Remote Desktop protocol to execute code on the target system. The flaw leads to arbitrary code execution, giving an attacker full control over the affected machine.

Microsoft Remote Desktop client for Windows Desktop, Windows 11 versions 23H2, 24H2, 25H2, and 26H1, and Windows Server 2022 and 2025, including Server Core installations are affected. The vulnerability exists in the client component across these Windows releases without a specified patch version in the description.

The flaw carries a CVSS score of 7.5, indicating high severity. The EPSS score is not published, so the current exploitation probability is uncertain; the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits yet. Nonetheless, because an attacker could achieve remote code execution, the risk remains significant. The likely attack vector involves sending malicious RDP packets to an exposed Remote Desktop service, so an attacker with network access to the RDP port can exploit the flaw if the client is in use.