Loading vulnerability…
Remote Code Execution in Windows Remote Desktop Services
CVE-2025-24045 is a remote code execution vulnerability in Windows Remote Desktop Services. The flaw is described as sensitive data storage in improperly locked memory, indicating that security-sensitive data is not adequately protected against concurrent access or exposure during processing. Available reporting further indicates that exploitation is tied to a race condition, and that a remote, unauthenticated attacker may be able to trigger code execution over the network if the race is won. The issue affects the Remote Desktop Services attack surface and was assigned a Microsoft-assessed CVSS base score of 8.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in remote code execution on a vulnerable Windows system exposing Remote Desktop Services. Because the issue is reachable over the network and does not require prior authentication, compromise could allow an attacker to run arbitrary code in the context of the affected service, potentially leading to full system compromise, follow-on lateral movement, deployment of malware, or disruption of remote access infrastructure.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of Remote Desktop Services to untrusted networks, restrict access through network segmentation and allowlisting, and require access through controlled remote access gateways or VPNs rather than direct exposure. Monitor Remote Desktop Services for anomalous connection attempts and consider temporarily disabling or limiting the service on systems where it is not operationally required. These measures reduce attack surface but do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Apply the March 2025 Microsoft security updates for Windows versions affected by CVE-2025-24045. Organizations should prioritize patching systems that expose Remote Desktop Services to untrusted networks or that provide remote access functions in enterprise environments. Standard remediation is vendor patch deployment across all affected client and server builds.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.