An uninitialized resource within Windows Remote Access Connection Manager permits an attacker who already has local user-level access to elevate privileges. The flaw arises from improper handling of an uninitialized variable, categorised as CWE-416 and CWE-908. The vulnerability requires that the attacker be authorised to invoke or configure the Remote Access service, after which they can obtain higher system privileges on the affected machine.

The vulnerability affects a broad range of Microsoft Windows operating systems. On the client side, Windows 10 build 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2 and 22H3, are all impacted. On the server side, Windows Server 2008 R2 SP1, Windows Server 2008 SP2, Windows Server 2012, 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022 (including the 23H2 edition), and Windows Server 2025 (including Server Core installations) are also vulnerable.

The CVSS base score of 7.8 indicates a high severity level. With an EPSS score of 2% the likelihood of exploitation in the wild is currently considered very low, and the vulnerability is not listed in the CISA KEV catalog. However, because the attacker must have local access and authorization to use the Remote Access Connection Manager, the risk is only for users with such permissions. If compromised, the attacker could elevate their privileges to system level, gaining full control of the affected machine. The exploit does not require network access or remote code execution; it is a local privilege escalation scenario that can be triggered by invoking or configuring the Remote Access service.