An use after free flaw in the Windows Remote Desktop Client allows an attacker to execute arbitrary code while the client is running, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is a classic 'use after free' weakness identified as CWE-416, which enables malicious code payloads to be delivered over the network.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and core installations. Versions are listed in the CNA vendor/product list and cover both x86 and x64 architectures as well as ARM64 for specific Windows 11 releases.

The CVSS score of 7.5 indicates a high severity for remote code execution. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified at this time, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a network-based Remote Desktop session initiated by an unauthorized attacker who can send crafted data to trigger the use‑after‑free condition. Attack prerequisites include RDP connectivity and exploitable client code, with no known local privilege restrictions reported.