A use‑after‑free flaw in the Windows Remote Desktop Client allows an unauthenticated network attacker to execute arbitrary code, potentially granting them full control of the target system. This weakness is identified as CWE‑416 and enables code execution by manipulating memory that has already been freed.

Affected Microsoft Windows releases include Windows 10 builds 1607, 1809, 21H2, and 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows 11 for ARM64‑based systems, as well as Windows Server editions 2012 (x64 and Server Core), 2012 R2 (x64 and Server Core), 2016 (x64 and Server Core), 2019 (x64 and Server Core), 2022 (x64), and 2025 (x64 and Server Core).

The CVSS score of 7.5 highlights a medium‑to‑high severity vector; the EPSS score is not available, and the vulnerability is not listed under CISA KEV, suggesting no known active exploitation in the wild at the time of analysis. The exploit requires an open RDP service and realistic network connectivity to the victim – the likely attack vector is a remote attacker sending a crafted RDP packet that triggers the use‑after‑free during client processing. Successful exploitation would lead to code execution with the privileges of the RDP user, which in many environments is elevated, making the risk significant.