A use‑after‑free bug in the Remote Desktop Client permits an unauthenticated attacker to exfiltrate a program counter pointer and execute arbitrary code. The flaw is classified as CWE‑416 and results in full code‑execution capability, enabling the attacker to compromise confidentiality, integrity, and availability of the affected system.

Affected Microsoft products include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server editions 2012 (RTM and Server Core), 2012 R2, 2016, 2019, 2022, and 2025 (Server Core). The Microsoft Security Response Center advises reviewing the referenced advisory for detailed model coverage.

The CVSS score is 7.5, indicating a high severity. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog. It is reasonable to infer that exploitation requires remote network access to RDP, as the attack vector relates to Remote Desktop traffic. No public exploit has been reported, but the lack of mitigation patches at time of discovery suggests active development of solutions.