The vulnerability is a use‑after‑free bug in the Remote Desktop Client that permits an attacker to send malicious network traffic and trigger the execution of arbitrary code on the target machine. Successful exploitation would allow the attacker to gain full control of the system, compromising confidentiality, integrity, and availability of the affected host.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and their Server Core installations.

The CVSS score is 7.5, indicating a high severity. EPSS is not available, but the exploit is not documented in the CISA KEV catalog. The likely attack vector is remote network traffic over RDP. An attacker would need to be able to send crafted packets to the Remote Desktop Service; internal attackers, malicious insiders or compromised systems can also exploit this. Although no central public exploit is known, use‑after‑free bugs often provide a powerful entry point for attackers once they develop an exploit.