The vulnerability is a use‑after‑free in the Remote Desktop Client that permits an unauthenticated attacker to run arbitrary code on the target operating system. An attacker who can send specially crafted Remote Desktop Protocol traffic can trigger the vulnerable function, resulting in remote code execution that compromises the confidentiality, integrity, and availability of the affected Windows system. This type of flaw is a classic example of CWE‑416.

The flaw affects multiple editions of Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1) as well as Windows Server releases from 2012 through 2025, including both full and Server Core installations. The list includes x86 and x64 as well as arm64 architectures, as indicated by the associated CPE entries.

The CVSS core score of 7.5 indicates a high severity threat. Exploit probability is unclear because no EPSS data is available, and the flaw is not currently listed in the CISA KEV catalog. While the description does not specify prerequisites, the network‑based nature of Remote Desktop traffic implies that an attacker can attempt exploit from outside the host without local privilege. The lack of publicly known exploitation details suggests that active exploitation may be limited, but the high potential for remote code execution warrants caution.