A deadlock within Windows Routing and Remote Access Service (RRAS) can be triggered by an attacker over a network, causing RRAS to freeze and the service to become unavailable. This results in a denial of service that affects routing and remote access services but does not compromise data confidentiality or integrity. The weakness is a deadlock condition (CWE‑833).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the ARM64‑based builds of Windows 11 26h2; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including both standard and Server Core installations.

The CVSS score of 7.5 reflects a high impact on availability. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, meaning no documented exploitation yet. The likely vector is unauthenticated network traffic targeting RRAS, inferred from the description that the deadlock can be triggered over a network. Because no privilege escalation is required, any packet sent to RRAS from an untrusted network could potentially trigger the deadlock, making the risk significant for systems exposing RRAS to external traffic.