A heap-based buffer overflow in the Remote Desktop Client allows an attacker who is not authenticated to execute arbitrary code on the target system. The vulnerability originates from improper handling of user-supplied data in memory, which can corrupt the heap and give attackers control of the call stack. The primary impact is loss of confidentiality, integrity, and availability because an attacker can run any code with the privileges of the client process, potentially enabling lateral movement or privilege escalation.

The flaw affects multiple Windows releases, including Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server 2012 through 2025 releases. The product list includes both consumer and server editions, with both x86 and x64 architectures, as well as ARM64 versions for Windows 10 21H2 and Windows 11. These versions were identified by Microsoft’s CNA. The exact build numbers and patch status are not listed here, so all unpatched instances in the affected families are at risk.

The CVSS score of 8.8 classifies the vulnerability as High, indicating that exploitation could have serious consequences. No EPSS value is available, but the lack of a publicly listed KEV entry does not reduce the potential risk; the vendor has acknowledged the issue, meaning a patch is likely forthcoming. The attack vector is a remote network connection, so an adversary only needs the ability to establish a Remote Desktop session or send traffic to the vulnerable client. Because the flaw does not require local privileges or user interaction, the likelihood of exploitation is non‑negligible, especially in environments with exposed Remote Desktop Services.