Remote Desktop Gateway Service Elevation of Privilege Vulnerability

An attacker with valid credentials on your network could exploit this to gain higher-level access on a Windows Server or workstation running Remote Desktop Gateway, potentially allowing them to access sensitive systems or bypass network access controls.

IT and security teams managing Windows Server (2016, 2019, 2022, 2025) or Windows 10 workstations (versions 1607, 1809) that use Remote Desktop Gateway for remote access. This primarily affects network administrators, organizations with hybrid or remote work infrastructure, and facilities managing remote connections to operational systems.

An attacker with valid network credentials connects to a system running Remote Desktop Gateway Service, triggers a use-after-free condition in the service, and exploits it to run code with elevated privileges. User interaction (such as a specific action on the attacker's part or configuration) is required to trigger the vulnerability.