Use After Free vulnerability in the Remote Desktop Client allows an attacker to execute code when the client processes malicious Remote Desktop Protocol traffic. The flaw arises because the client frees memory and then attempts to access it again, permitting arbitrary code execution on the target system. If successful, an attacker can take full control of the device, compromising confidentiality, integrity, and availability of the host and any data the user accesses.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1), Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations, across x86, x64, and ARM64 architectures. Both Desktop and Server editions are impacted as the Remote Desktop Client component is present in all listed products.

CVSS score of 7.5 indicates a high likelihood that remote attackers can exploit the flaw. The EPSS score is not available, so current global exploitation probability is unknown. The vulnerability is not yet listed in the CISA KEV, but that does not preclude attackers from attempting exploitation. The attack vector is remote, requiring only network connectivity to an exposed Remote Desktop port (TCP 3389). An attacker can trigger the use‑after‑free by sending specially crafted RDP packets; no authentication is required. Once triggered, arbitrary code will run with the privileges of the RDP client process.