An uninitialized resource in Windows Remote Access Connection Manager enables a user with appropriate local privileges to trigger a change in system privilege level, potentially allowing the attacker to execute actions as a higher‑privileged account. The weakness can be exploited when the attacker has the ability to invoke or configure the Remote Access service, leading to control over system resources, access to sensitive data, and the ability to launch further attacks. The class of defect aligns with CWE‑416 (Use After Free) and CWE‑908 (Improper Handling of Uninitialized Variables).

The vulnerability affects a broad range of Microsoft Windows operating systems. On the client side, Windows 10 build 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2 and 22H3, are all impacted. On the server side, Windows Server 2008 R2 SP1, Windows Server 2008 SP2, Windows Server 2012, 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 (including the 23H2 edition), and Windows Server 2025 (including Server Core installations) are also vulnerable.

The CVSS base score of 7.8 indicates a high severity level. With an EPSS score of less than 1% the likelihood of exploitation in the wild is currently considered very low, and the vulnerability is not listed in the CISA KEV catalog. However, because the attacker must have local access and authorization to use the Remote Access Connection Manager, the risk is only for users with such permissions. If compromised, the attacker could elevate their privileges to system level, gaining full control of the affected machine. The exploit does not require network access or remote code execution; it is a local privilege escalation scenario that can be triggered by subtle configuration or operation of the Remote Access service.