This vulnerability (CVE-2026-42985) involves a use-after-free condition in the Microsoft Remote Desktop client for Windows Desktop (version 1.2.0.0). Exploitation of this flaw could allow an attacker to execute arbitrary code remotely without requiring privileges, though user interaction is needed. The vulnerability has been assigned a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for the Remote Desktop client to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42985 for detailed patching instructions.