A use‑after‑free flaw in the Remote Desktop Client can be triggered by an attacker who has network access to a system. The vulnerability allows the attacker to execute arbitrary code as the local user, potentially giving full control of the affected machine. This weakness is an instance of the CWE‑416 "Use After Free" error, which can corrupt memory and lead to code execution.

The flaw affects various Windows 10 releases (1607, 1809, 21H2, 22H2) as well as multiple Windows 11 releases (23H2, 24H2, 25H2, 26H2, 26H1) and the Windows Server line from 2012 (and its core installations) through 2025. All affected platforms use the Remote Desktop Client component, regardless of architecture (x86, x64, arm64). This includes both standard and core server installations.

The CVSS score of 7.5 indicates significant potential for compromise, and the absence of an EPSS score means the exploitation probability is unknown. The vulnerability has not been listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. However, the attack vector is network‑based, meaning any host reachable via Remote Desktop can be targeted. Successful exploitation would allow an attacker to run arbitrary code, compromising confidentiality, integrity, and availability of the system.