A use-after-free flaw in the Microsoft Remote Desktop Client permits an attacker who can send crafted data over the network to execute arbitrary code on the target system. This vulnerability aligns with CWE-416 and could allow full system compromise if the attacker successfully triggers the flaw.

The flaw affects multiple Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and a range of Windows Server editions from 2012 through 2025, including standard and Server Core installations for 2012, 2012 R2, 2016, 2019, 2022, and 2025.

With a CVSS score of 8.8 the vulnerability is rated high severity, yet the EPSS score of less than 1% indicates a very low probability of real-world exploitation. It is not listed in the CISA KEV catalog, suggesting no actively used exploit in the wild. The attack vector is most likely a remote, network-based vector that requires no authentication to the target system. While the risk is lower due to the low exploitation probability, the potential impact warrants immediate remediation.