A heap‑based buffer overflow in Windows Remote Desktop Protocol allows an attacker who has established a remote desktop session to write beyond the intended memory bounds and obtain a higher privileged token, effectively moving from a standard user to SYSTEM level. This local privilege escalation can compromise confidentiality, integrity, and availability on the compromised host, enabling the attacker to modify or delete files, install malware, or extract sensitive information. The weakness corresponds to CWE-122, which describes improper handling of heap memory.

Affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations. Any system running one of these versions with Remote Desktop Services enabled is vulnerable if not patched.

The CVSS score of 7.8 rating the vulnerability as high severity indicates substantial impact if exploited. EPSS is not available, so the current exploitation probability cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local RDP session; thus an attacker who can authenticate to the system via Remote Desktop can attempt the overflow to elevate privileges. While no public exploits are reported, the requirement of authorized RDP access reduces the attack surface compared to an unauthenticated remote flaw.