CVE-2025-26671
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Apr 8, 2025
Updated: Apr 9, 2025
CWE ID 416
CWE ID 591
Summary
CVE-2025-26671 is a use-after-free vulnerability affecting Windows Remote Desktop Services. This issue permits unauthorized attackers to execute code over a network by exploiting the memory vulnerability in the Remote Desktop Protocol (RDP) server. Successful exploitation could result in the attacker gaining control of the targeted system, potentially leading to data theft or further system compromise. It is recommended that affected systems are immediately patched to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Microsoft Windows Server 2008 R2
- Microsoft Windows Server 2022
Affected Vendors
- Microsoft