A use‑after‑free flaw in Microsoft’s Remote Desktop Client lets an attacker with network access craft Remote Desktop Protocol traffic that triggers the client to run arbitrary code. No elevated privileges are required, and execution occurs in the context of the client user, allowing full compromise of confidentiality, integrity, and availability of the victim system.

Affected systems are Microsoft Windows 10 releases from version 1607 through 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server‑Core installations and the x86, x64, and ARM64 architectures.

With a CVSS score of 7.5 the vulnerability is rated high severity. The EPSS score is not available, so the current prevalence of exploitation is unknown. It is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote over the network via the RDP port (TCP 3389), requiring only the ability to send specially crafted RDP packets to a vulnerable client; no prior compromise or privileged access is needed.