This vulnerability is caused by an untrusted pointer dereference in the Windows Routing and Remote Access Service (RRAS). The flaw allows an attacker who can reach the affected system over the network to execute arbitrary code. The impact is the full compromise of the affected machine, giving the attacker potential access to data, control of services, or wider network intrusion. The weakness is classified as CWE‑822, a NULL or dangling pointer dereference.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 22H3), and Windows Server releases 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, and 2025. The flaw exists on systems that have the RRAS feature enabled, including both full‑install and Server Core configurations.

The CVSS score of 8.8 classifies this issue as High severity, indicating that successful exploitation would grant significant privileges. The EPSS score of less than 1 % suggests a low but non‑zero probability of exploitation. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a network‑based path that relies on the RRAS service being enabled and no authentication barrier; this is inferred because the description states the flaw can be triggered by an unauthorized attacker over a network. Once the attacker triggers the pointer dereference, arbitrary code can be executed with the privileges of the RRAS service.