The vulnerability is a heap‑based buffer overflow in Microsoft Remote Desktop Client that allows an unauthorized attacker to execute arbitrary code on a victim machine over the network. The flaw is triggered by specially crafted data received by the client, potentially from an untrusted remote host. Successful exploitation would compromise the confidentiality, integrity, and availability of the affected system by allowing the attacker to run code with the privileges of the logged‑in user, leading to full system compromise.

Affected products include Microsoft Remote Desktop Client for Windows Desktop (including Windows 10 builds 1607, 1809, 21H2, and 22H2) and Windows 11 builds 23H2, 24H2, 25H2, and 26H1), the Windows App Client for Windows Desktop, and the Remote Desktop Client on Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both x86 and x64 (and ARM64 for Windows 11) architectures are impacted.

With a CVSS score of 8.8, the flaw is considered high severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog, suggesting limited known exploitation at this time. The likely attack vector is a remote network connection, where an adversary controls a remote host or serves malicious data to the client during an RDP session. If exploited, an attacker can gain code execution without local privileges, leading to full system compromise.