Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. This flaw introduces a classic use‑after‑free vulnerability that can be triggered by sending specially crafted RDP packets, resulting in arbitrary code execution with the privileges of the Remote Desktop Services process. The impact is full compromise of the affected host, providing the attacker with confidentiality, integrity, and availability control through arbitrary code execution. The weakness is classified as CWE‑416.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and Windows Server 2012 (including server core), 2012 R2, 2016, 2019, 2022, and 2025 (including server core). These cover desktop and server operating systems across x86, x64, and ARM64 architectures.

With a CVSS score of 7.5, the vulnerability is considered high severity; the EPSS score is unavailable, so the current exploitation probability cannot be quantified, and the flaw is not listed in the CISA KEV catalogue. The likely attack vector is network‑based, requiring connectivity to the Remote Desktop Services port, and no local privileges are needed to attempt exploitation. The lack of an official workaround and the absence of a published exploit at the time of analysis mean that the primary defense is to apply the Microsoft security update as soon as possible, with interim mitigations such as disabling RDP or restricting it to trusted networks.