The vulnerability is an integer overflow or wraparound in the Windows Routing and Remote Access Service (RRAS). An authorized attacker can send crafted network traffic that causes the service to execute arbitrary code on the affected system. This type of flaw permits code execution without user interaction or elevated privileges on the host, leading to full control over the targeted machine.

Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 22H3 and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 are all affected. The flaw resides in the RRAS component, which provides routing and VPN functionality on these operating systems.

The CVSS score of 8 indicates a high severity, but the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, which means no active exploitation is publicly documented. An attacker must be authorized to send traffic to the RRAS service over the network; the overflow allows arbitrary code execution once the crafted packet is processed.