The vulnerability arises from use of an uninitialized resource within the Remote Desktop Client. An attacker who already has authorized RDP access can trigger this flaw to execute arbitrary code on the target system. The result is a remote code execution that grants the attacker full control over the compromised machine, compromising confidentiality, integrity, and availability.

Affected products include several Microsoft Windows operating systems. The flaw impacts Windows 10 releases starting with Version 1607 up through 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 23H2. It also affects Windows Server editions 2016 (standard and server core), 2019 (standard and server core), 2022, and 2025 (including server core).

The CVSS score of 7.1 indicates moderate‑high severity, and the EPSS score is not available, so current exploitation likelihood cannot be quantified. The issue is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector requires an attacker to have valid RDP credentials or to have privileged network access to a machine that has Remote Desktop enabled, making the window of opportunity limited to authorized users or internal adversaries. Organizations should therefore promptly apply the vendor patch and enforce strict RDP controls to mitigate risk.