The flaw is a use‑after‑free in the Windows Remote Desktop client that allows an attacker to execute arbitrary code when the client processes network traffic. The problem occurs when the client dereferences freed memory during its rendering routine, enabling an attacker to inject malicious data that is later executed. This leads to full compromise of confidentiality, integrity, and availability for the target system.

Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server releases 2012 through 2025 are all affected. The list provided by the CNA includes all mainstream and server builds in those ranges, but no further version filtering is specified.

The CVSS base score of 7.5 indicates a high severity risk. EPSS data is not available and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that a documented exploit has not yet been observed. The attack vector is network‑based; an attacker must reach the Remote Desktop Client over the network and supply crafted traffic to trigger the use‑after‑free. The lack of production exploitation evidence implies the risk might remain moderate until a public exploit is released, but because any code execution is possible, the potential impact is severe.