A heap‑based buffer overflow in the Remote Desktop Client allows an unauthorized attacker to execute arbitrary code remotely. This flaw can be triggered during the processing of RDP traffic and, if exploited, enables the attacker to run code with the privileges of the RDP session, potentially compromising the entire host. The vulnerability falls under CWE‑122, a classic buffer overflow condition.

The flaw affects all Microsoft Remote Desktop Client installations for Windows Desktop and Windows App Client, including Windows 10 versions 1607 through 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1, as well as all Windows Server releases from 2012 to 2025. Any system that has Remote Desktop enabled and is reachable over the network is potentially vulnerable.

The CVSS score of 7.5 indicates a high severity for remote code execution. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV, suggesting that widespread active exploitation has not been reported. The attack vector is inferred to be network‑based through RDP traffic. Affected users must address the flaw promptly to prevent unauthorized execution of code on their systems.