A critical use after free vulnerability in Windows Remote Desktop Services allows unauthenticated attackers to achieve remote code execution, posing a severe threat to system integrity.

This is a use after free flaw (CWE-416) within the Remote Desktop Services component. The vulnerability is exploitable by an unauthenticated attacker over the network without requiring user interaction.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it facilitates full system compromise without any prerequisites. Successful exploitation allows an attacker to gain complete control over the affected system, leading to data exfiltration, malware installation, and potential lateral movement within the network. This represents a significant risk to organizational operations and data confidentiality.

Immediate Action: Apply the security updates provided by Microsoft in the September 2026 update cycle to reach the specified fixed versions.

Proactive Monitoring: Monitor network traffic for unusual Remote Desktop Protocol (RDP) activity and review system logs for suspicious process execution originating from the RDP service.

Compensating Controls: Restrict access to Remote Desktop Services using firewalls or VPNs to ensure that only authorized sources can communicate with the service, effectively reducing the attack surface.

Public Exploit Available: Unknown

Given the critical CVSS score and the potential for remote code execution, this vulnerability demands immediate attention. System administrators must prioritize patching all affected Windows instances to the specified versions to eliminate this high-risk attack vector. Failure to remediate could result in total system compromise.