The vulnerability is a use‑after‑free in the Windows Remote Desktop Client. Based on the description, it is inferred that an attacker who can initiate a Remote Desktop Protocol session can cause the client to execute arbitrary code. The primary impact is remote code execution, giving the attacker full control of the affected system. The weakness is a classic use‑after‑free (CWE‑416), which can corrupt memory and lead to arbitrary code execution when the client processes a malicious RDP stream.

All listed Microsoft Windows client and server products from Windows 10 Version 1607 through Windows 11 Version 26H2 and the corresponding server editions from Windows Server 2012 to Windows Server 2025 are affected.

The CVSS score is 7.5, signifying high severity. EPSS is not available, so the current known exploitation probability cannot be quantified. The vulnerability is not cited in the CISA KEV catalog, which suggests no publicly known active exploits at the time of this advisory. Based on the description, it is inferred that the likely attack vector is network‑based; an attacker who can establish a Remote Desktop session or send a crafted RDP packet to the victim can trigger the use‑after‑free. Successful exploitation would result in arbitrary code execution on the target machine.