Remote Desktop Client Remote Code Execution Vulnerability

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

How could an attacker exploit this vulnerability?
In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the machine when a victim connects to the attacking server with the vulnerable Remote Desktop Client.

Security updates
10.0.17763.8880 — https://support.microsoft.com/help/5094123
1.2.7214.0 — https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windowsdesktop-whatsnew
10.0.20348.5256 — https://support.microsoft.com/help/5094128
10.0.19044.7417 — https://support.microsoft.com/help/5094127
10.0.26100.32995 — https://support.microsoft.com/help/5094125
10.0.26200.8655 — https://support.microsoft.com/help/5094126
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.28000.2269 — https://support.microsoft.com/help/5095051
10.0.14393.9234 — https://support.microsoft.com/help/5094122
6.2.9200.26132 — https://support.microsoft.com/help/5094042
6.3.9600.23228 — https://support.microsoft.com/help/5094041
2.0.1193.0 — https://learn.microsoft.com/en-us/windows-app/whats-new?toc=admins%2Ftoc.json&tabs=windows