The vulnerability is a classic use‑after‑free bug in the Remote Desktop Client that allows an attacker to trigger arbitrary code execution when the client processes a crafted packet. Because the code runs with the privileges of the client application, exploitation could grant the attacker full control of the impacted system, compromising confidentiality, integrity, and availability. The flaw falls under CWE‑416 and presents a classic remote‑code‑execution scenario.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012 through 2025 (both full and Core installations). Affected architectures include x86, x64 and arm64 variants.

The CVSS score of 7.5 indicates a high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is over the network via the Remote Desktop Protocol; an unauthenticated attacker can send a malicious packet while the client is connected, exploiting the use‑after‑free to run arbitrary code. The potential privilege level of compromise is that of the client process, which is inferred from the description.