The vulnerability is a classic out‑of‑bounds read in the Remote Desktop Client component of the Windows App for Mac. When an attacker sends specially crafted packets to the client, the application may read memory beyond intended bounds and transmit the retrieved data to the attacker over the network, thus revealing arbitrary information that the client could access. This flaw directly compromises confidentiality.

Microsoft’s Windows App for Mac is affected. No specific version or build numbers were enumerated in the advisory, so any deployment of the application that contains this unpatched Remote Desktop Client component remains vulnerable until a vendor update is released.

The CVSS score of 6.5 indicates a moderate severity for this disclosure vulnerability. The EPSS score is reported as < 1%, which means the probability of exploitation is very low but not zero. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote network connection to the Remote Desktop Client; an attacker would need to be able to send packets to the client, which may be exposed by the client being listening for connections or by a user accepting a remote session. Exploitation requires no special local privileges and would allow an attacker to read arbitrary internal data the application could reach.