A memory corruption vulnerability exploits a use‑after‑free condition in Windows Remote Desktop Protocol, allowing an adversary who has authenticated to the target system to elevate their privileges to that of the local user. The flaw is categorized as CWE-416, meaning that an attacker can trigger an undefined behavior by manipulating memory after it has been freed, resulting in the execution of arbitrary code or escalation of privileges. This can lead to full system compromise, data theft, and disruption of services as the attacker can access, modify, or delete files, install malware, or pivot to other systems in the network.

Affected devices include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and server core installations. The vulnerability applies to both x86 and x64 architectures, and for Windows 11 ARM64-based systems. All listed build variants must be assessed for the presence of the RDP use‑after‑free flaw.

The CVSS score of 7 indicates a high severity vulnerability, and because the exploit requires an authorized RDP session, the likelihood of successful exploitation depends on network exposure and user credentials. EPSS data is currently unavailable, so historical exploitation trends cannot be evaluated. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread use in zero‑day attacks yet, but the high impact justifies timely remediation.