The vulnerability is a buffer over-read in the Windows Routing and Remote Access Service (RRAS). An attacker with network access can trigger an unauthorized read of memory contents, potentially exposing sensitive data. Because RRAS runs as a privileged system component, the information leaked may include configuration or otherwise confidential data, leading to confidentiality compromise. The weakness corresponds to CWE-126, a classic memory buffer over-read scenario.

This flaw affects a wide range of Microsoft operating systems, both desktop and server, from Windows 10 version 1607 through Windows 11 variants up to 25H2 and 22H3. It also includes multiple releases of Windows Server—2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, 23H2, and 2025—across x86,64, and ARM64 architectures where applicable, demonstrating broad exposure across enterprise environments.

The CVSS score of 6.5 classifies the issue as medium severity, but the EPSS score is below 1%, indicating a very low current exploitation probability. It is not listed in the CISA KEV catalog, suggesting limited active exploitation. Nevertheless, because the attacker needs network access to the target and the vulnerability resides in a core routing service, the potential impact for an affected system could be significant if an attacker can obtain privileged data. In environments where RRAS is exposed to untrusted networks, the risk is elevated.