Severe RD Gateway Security Flaw Enables Remote Code Execution
A newly uncovered security flaw in Microsoft’s Remote Desktop Gateway (RD Gateway) opens the door for remote attackers to execute arbitrary code on vulnerable servers. Identified as CVE-2025-21297, this high-risk issue was spotlighted in Microsoft’s January 2025 patch release and is already being weaponized in live attacks.
The vulnerability was uncovered by Tang Tianwen (VictorV) of Kunlun Lab and arises from a use-after-free (UAF) condition rooted in the aaedge.dll module. Specifically, the flaw exists within the CTsgMsgServer::GetCTsgMsgServerInstance function, where a global pointer (m_pMsgSvrInstance) is initialized without adequate thread locking. This lack of synchronization creates a dangerous race condition.
According to the advisory, simultaneous socket connections can overwrite the same memory pointer without warning, leading to reference count corruption and eventual dereferencing of a stale pointer—an archetypal UAF flaw. The resulting memory mismanagement allows attackers to hijack control flow and execute malicious code.
Microsoft has rated the flaw as high severity (CVSS 8.1) due to the relative ease of exploitation and the critical systems it affects.
Exploitation Mechanics
To successfully leverage the bug, a threat actor must:
- Establish a session with a target running the RD Gateway role.
- Initiate multiple concurrent socket connections.
- Exploit a narrow window where thread execution overlaps during pointer initialization.
- Cause one connection to tamper with the pointer before the others complete referencing it.
This orchestrated sequence of thread collisions culminates in heap memory corruption, allowing the attacker to reclaim and execute freed memory blocks.
Impacted Systems
The vulnerability affects the following Microsoft Server platforms:
- Windows Server 2016 (Core & Standard)
- Windows Server 2019 (Core & Standard)
- Windows Server 2022 (Core & Standard)
- Windows Server 2025 (Core & Standard)
These systems are commonly deployed as secure remote access solutions for organizations managing distributed workforces, contractors, and third-party partners. As such, the implications for enterprise security are significant.
Organizations using RD Gateway should apply Microsoft’s security updates immediately and monitor for signs of unusual RD Gateway activity.
Microsoft Deploys Targeted Fix for RD Gateway Exploit in May 2025 Security Update
In response to a high-impact Remote Desktop Gateway (RD Gateway) flaw, Microsoft rolled out a critical fix as part of its May 2025 Patch Tuesday release. The mitigation involves the implementation of mutex-based synchronization, a threading control mechanism designed to prevent simultaneous initialization of a shared global resource—effectively eliminating the underlying race condition.
These are the relevant security updates by platform:
- Windows Server 2016: KB5050011
- Windows Server 2019: KB5050008 (Build 10.0.17763.6775)
- Windows Server 2022: KB5049983 (Build 10.0.20348.3091)
- Windows Server 2025: KB5050009 (Build 10.0.26100.2894)
Immediate Action Recommended
Security professionals are urging swift deployment of these patches, especially in organizations where RD Gateway serves as a front line for remote access. “This issue poses a significant exposure for enterprise networks relying on RD Gateway to control and secure external connectivity,” warned one researcher familiar with the patching details.
Interim Safeguards
For environments where immediate patching isn’t feasible, organizations should adopt compensating controls. Recommended actions include:
- Vigilant monitoring of RD Gateway logs for any anomalies.
- Restricting RD Gateway access at the network perimeter to known, trusted IP ranges.
- Reviewing firewall and segmentation rules to ensure lateral movement is contained in case of compromise.
Proactive mitigation and patching are essential to prevent attackers from taking advantage of this vulnerability, which is confirmed to be under active exploitation.
