Windows Remote Desktop Services Elevation of Privilege Vulnerability

An attacker with a valid user account on a Windows system running Remote Desktop Services could exploit a use-after-free flaw to run commands with elevated privileges, potentially gaining full control of the affected machine. For OT environments, this means an attacker with compromised operator credentials could escalate to administrative access and alter industrial control system settings or shut down critical services.

Windows administrators and OT facility personnel who use Remote Desktop Services to manage Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems, including HMI workstations, data historian servers, and Windows-based industrial PCs. This impacts any facility where RDS is used for remote operations or engineering access.

An attacker must first obtain valid credentials for a user account on the Windows system (e.g., through phishing, credential theft, or a compromised HMI workstation). They then connect via Remote Desktop Services and trigger the use-after-free vulnerability in the RDS service memory handling. This allows the attacker to execute arbitrary commands with administrator-level privileges on the same machine.