The vulnerability is a use after free flaw in the Remote Desktop Client that lets an unauthorized attacker execute arbitrary code when a remote session is established. This flaw can be leveraged over the network to compromise confidentiality, integrity, and availability of the affected system, and it arises from a classic memory‑management weakness identified as CWE‑416.

Microsoft Windows 10, versions 1607, 1809, 21H2, and 22H2; Windows 11, versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including their Server Core variants). The affected builds run on x86, x64, and arm64 architectures.

The CVSS score of 7.5 indicates a moderate‑to‑high severity vulnerability that can be exploited from a remote network location with no special privileges. The EPSS score is not available, so current exploitation probability is unclear, and the issue is not listed in the CISA KEV catalog. Attackers who gain network access to a Remote Desktop session can trigger the use‑after‑free condition and execute code with the privileges of the Remote Desktop service.