This vulnerability is a use-after-free condition in the Microsoft Remote Desktop client for Windows Desktop, specifically version 1.2.0.0. It results in a heap-based buffer overflow that could be exploited by an attacker to execute arbitrary code remotely. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, and requiring user interaction. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code on the affected system remotely, potentially leading to full compromise of confidentiality, integrity, and availability of the system running the vulnerable Remote Desktop client.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Remote Desktop client version 1.2.0.0 as soon as possible to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44801 for detailed patch information and update instructions.