An integer overflow or wraparound flaw exists in the Windows Routing and Remote Access Service (RRAS). The condition can be triggered by crafted network input, allowing an attacker who has authorized access to the target system to execute arbitrary code. This results in full compromise of the affected device, enabling manipulation of the operating system, data exfiltration or further lateral movement within the network.

Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2) and Windows 11 (Versions 22H3, 23H2, 24H2, 25H2, 26H1) are affected, as well as a range of server products including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Any installation with RRAS enabled in these operating systems is susceptible.

The vulnerability carries a CVSS score of 8, indicating high severity, but the EPSS score is below 1 % and it is not listed in CISA's KEV catalog, suggesting a low likelihood of mass exploitation. An attacker would need to be authenticated or have sufficient privileges on the network to contact the RRAS service; exploitation requires that the service is running. Once exploited, the attacker obtains code execution privileges on the host.