An integer overflow or wraparound flaw exists in the Windows Routing and Remote Access Service (RRAS) that allows an attacker with authorized access to transmit specially crafted packets to the service. The flaw causes the service to write data beyond the intended buffer boundaries, enabling the execution of arbitrary code on the host machine. Successful exploitation would give the attacker full control over the operating system and the ability to install further malicious components.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations.

The CVSS score of 8.0 indicates a high severity, and the EPSS score of less than 1 % suggests a low short‑term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote network communication with the RRAS service, and the attacker must possess authorized access to the target system or be able to authenticate to the service. Once the flaw is triggered, the attacker can run arbitrary code with privileges that RRAS typically claims, potentially escalating to SYSTEM level. The overall risk is therefore high for affected hosts that expose RRAS to external networks or are managed by users with elevated privileges.