CVE-2026-32157

CVE-2026-32157 is a use-after-free vulnerability in the Remote Desktop Client that permits unauthenticated attackers to execute arbitrary code over a network. This memory safety flaw allows an attacker to leverage freed memory regions to achieve remote code execution with no authentication required. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector and low complexity, indicating it can be exploited easily from the network without special privileges. User interaction is required to trigger the vulnerability, but the impact is severe, affecting confidentiality, integrity, and availability of the affected system. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog and remains inactive on threat intelligence hot lists. With an EPSS score of 0.001, the probability of exploitation is minimal relative to other known vulnerabilities, suggesting limited immediate threat activity despite the high technical severity rating.