A heap‑based buffer overflow exists in the Remote Desktop Client that permits an attacker who can communicate over the network to execute arbitrary code on the target system. The flaw is exploitable by an unauthorized attacker and grants them the ability to run code with the privileges of the client process, potentially leading to full system compromise.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as the Windows App Client for Windows Desktop. Server‑side products included are Windows Server 2016, 2019, 2022, and 2025, both standard and Server Core installations. All mentioned builds are susceptible when the Remote Desktop Client is installed and operational.

The CVSS score of 7.5 classifies the flaw as high severity, though its EPSS score is currently unavailable and it is not listed in the C KEV catalog. Externally, an attacker would need only network reachability to a device running the vulnerable client; no privileged local access is required. The likely attack path involves connecting over the Remote Desktop protocol and delivering a crafted payload that triggers the overflow. Because the flaw can be reached from the network, it poses a significant risk to exposed systems.