This vulnerability (CVE-2026-61352) involves a concurrent execution issue caused by improper synchronization in the Remote Desktop Client on Windows 10 Version 1607 (build 10.0.14393.0). An attacker can exploit this race condition to execute arbitrary code remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity and user interaction. Microsoft has published an official fix to address this issue.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely on affected Windows 10 Version 1607 systems via the Remote Desktop Client. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61352 to remediate this vulnerability.