A heap‑based buffer overflow in the Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute arbitrary code by sending a specially crafted packet. The vulnerability can lead to full compromise of the affected system, resulting in loss of confidentiality, integrity, and availability.

Affected are multiple Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3, as well as Windows Server releases from 2008 R2 SP1 through 2025. Both feature and Server Core installations of RRAS are impacted.

The CVSS score of 8.8 denotes high severity, while the EPSS score of less than 1 percent indicates a low probability of automated exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the RRAS service and the ability to send a crafted packet; no authentication is required, thereby increasing the risk for exposed services.