An use‑after‑free flaw in the Remote Desktop Client allows an unauthorized attacker to execute arbitrary code over a network. The vulnerability can be triggered by crafted RDP traffic, resulting in a full compromise of confidentiality, integrity and availability on the affected system. The weakness is classified as CWE‑416, a classic use‑after‑free error.

Affected systems include Microsoft Windows 10 from version 1607, 1809, 21H2 and 22H2, Windows 11 from versions 23H2 through 26H2 (including 24H2, 25H2, 26H1, and 26H2), and Microsoft Windows Server editions ranging from 2012, 2012 R2, 2016, 2019, 2022, to 2025, including their Server Core installations.

The CVSS score of 7.5 indicates high severity, though the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires network access to the Remote Desktop Service and an attacker must be able to send crafted RDP packets, but no privileged user interaction is needed. Given the ability to obtain remote code execution, the risk to an exposed system is significant, and remediation should be prioritized.