This vulnerability involves a use-after-free condition in the Microsoft Remote Desktop client for Windows Desktop (version 1.2.0.0). Exploitation of this flaw could allow an attacker to execute arbitrary code remotely without requiring privileges, though user interaction is needed. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability as documented in their security update guide.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Remote Desktop client. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32157 to remediate this vulnerability.