This vulnerability is a use-after-free condition in the Remote Desktop Client on Windows Server 2016 (version 10.0.14393.0). It results in a heap-based buffer overflow that could be exploited by an attacker without privileges or user interaction to execute arbitrary code remotely. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, and requires user interaction. Confidentiality, integrity, and availability impacts are all high. Microsoft has released a temporary fix to mitigate this issue.

Successful exploitation could allow remote code execution by an unauthorized attacker, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

A temporary fix is available from Microsoft. Users should apply the temporary fix as recommended in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47654. Monitor the vendor advisory for updates regarding a permanent official fix.