The vulnerability is a null pointer dereference located in Windows Remote Access Connection Manager, which permits an attacker to cause a local denial of service. Classified as CWE‑476, it can lead to an abrupt crash of the RACC service, affecting service availability for local users.

Systems affected are Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2) and Windows 11 (builds 23H2, 24H2, 25H2, 26H1, 22H3, 26H1), as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and their Server Core variants. The list of impacted releases is enumerated in the vendor’s advisory, and the CPEs reflect each of these platforms.

The CVSS base score is 6.2, indicating moderate impact, while the EPSS score of 9% indicates a relatively high likelihood that exploitation may be occurring. The vulnerability is listed in the CISA KEV catalog, confirming it has been exploited in the wild. Attackers must have local or delegated access to the targeted machine to trigger the null reference; a crash of RACC results in a local denial of service, impacting the availability of the system for the user who triggered it. The exploit does not provide lateral movement or privacy compromise.