A critical heap-based buffer overflow in the Remote Desktop Client of Windows 11 and Windows Server 2025 creates a high risk of remote code execution.

The vulnerability is a heap-based buffer overflow within the Remote Desktop Client, which can be triggered by an unauthenticated attacker to achieve code execution.

The ability for an unauthenticated attacker to execute code remotely on a Windows system constitutes a critical security risk. With a CVSS score of 9.8, a successful exploit could result in full system compromise, allowing attackers to install malware, modify data, or create new administrative accounts, causing significant operational disruption.

Immediate Action: Apply the latest cumulative security updates for Windows 11 and Windows Server 2025 as provided by Microsoft.

Proactive Monitoring: Review RDP traffic logs for unusual connection patterns or anomalous activity originating from unauthorized sources.

Compensating Controls: Limit exposure of RDP services to the public internet by using a secure gateway or VPN, and ensure that NLA (Network Level Authentication) is strictly enforced.

Public Exploit Available: No confirmed public exploit available.

Organizations should treat this vulnerability with high urgency and deploy the relevant Microsoft patches across all affected Windows endpoints and servers. Prioritize systems that have RDP ports exposed to the internet or wide internal networks to reduce the attack surface.