This vulnerability (CVE-2026-44801) is a use-after-free condition in the Microsoft Remote Desktop client for Windows Desktop, specifically affecting version 1.2.0.0. It enables an unauthorized attacker to execute arbitrary code remotely over a network connection. The vulnerability has a CVSS v3.1 score of 7.5 with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this issue.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Remote Desktop client.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44801 to remediate this vulnerability.