Microsoft Windows Remote Desktop Services Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Windows Remote Desktop Services. This issue arises from a race condition that creates a use-after-free scenario, allowing an attacker to execute arbitrary code on the affected system. The vulnerability is present in several versions of Windows Server, including 2012, 2016, 2019, 2022, and 2025, as well as in Windows Server 2012 R2.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, connect to a system with the Remote Desktop Gateway role. Exploit the race condition to create a use-after-free scenario, which can then be leveraged to execute arbitrary code.

Remediation

Users can apply the security updates provided by Microsoft to address this vulnerability. These security updates are available through the Microsoft Update Catalog.