An integer overflow or wraparound flaw exists in the Windows Remote Desktop Protocol implementation. The overflow can be triggered by a specially crafted packet sent to an open RDP service, allowing an unauthenticated attacker to execute arbitrary code on the target machine. Successful exploitation compromises confidentiality, integrity, and availability, providing a full system takeover without user interaction.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full‑installer and Server Core editions.

The CVSS score of 8.8 denotes high severity, highlighting the critical nature of remote code execution. However, the EPSS score is below 1 %, indicating a low current threat of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the RDP channel; an attacker can send a crafted packet to any system exposing port 3389, even without prior authentication, to trigger the overflow and gain code‑execution privileges.