Loading vulnerability…
Windows Remote Desktop Services Remote Code Execution Vulnerability
CVE-2025-24035 is a remote code execution vulnerability in Windows Remote Desktop Services. The flaw is described as sensitive data storage in improperly locked memory, indicating that security-sensitive data is placed in memory that is not adequately protected against unintended access during concurrent operations. Available reporting further indicates that successful exploitation depends on winning a race condition. An unauthenticated remote attacker can target the exposed Remote Desktop Services component over the network and, under the right timing conditions, trigger the flaw to execute arbitrary code on the vulnerable system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution on a vulnerable Windows system hosting Remote Desktop Services. Because the issue is reachable over the network and does not require prior authentication, compromise could enable full attacker-controlled code execution in the context of the affected service, potentially leading to system takeover, follow-on privilege escalation, lateral movement, deployment of malware, or disruption of service availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of Remote Desktop Services by restricting network access to trusted management networks, disabling or limiting external RDP reachability, enforcing segmentation and firewall controls, and minimizing the number of systems with Remote Desktop Services exposed. Additional hardening such as VPN-gated administrative access and continuous monitoring for anomalous RDP activity can reduce risk, but these measures do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Apply the Microsoft March 2025 security updates for affected Windows versions and any corresponding Windows Server releases that include Remote Desktop Services. Prioritize internet-exposed and otherwise reachable RDS hosts. Standard remediation should include verifying patch deployment across all affected systems and ensuring unsupported platforms are upgraded or isolated if security updates are unavailable.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.