An use-after-free flaw in the Remote Desktop Gateway Service allows an attacker to run arbitrary code when a specially crafted network packet is processed, resulting in complete system compromise on the vulnerable host. The vulnerability is an instance of CWE-416, which designates unsafe memory handling as the root cause. If exploited, the attacker gains the privileges of the Remote Desktop service, which can be system-level depending on configuration, giving them full control over the affected server.

The flaw affects Microsoft Windows Server editions from 2012 through 2025, including their Server Core variants; the impact covers all x64 builds of these servers as listed by the Microsoft CNA. No other Microsoft products are known to be affected by this specific flaw.

The CVSS score of 8.1 places this vulnerability in the high severity category. EPSS data is not available, so the likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no widespread active exploitation reported yet. Attackers would need network access to the Remote Desktop Gateway Service, implying a remote attack vector over potentially untrusted networks.