This vulnerability is a CWE-416 use‑after‑free flaw in Windows Remote Access Connection Manager that allows an authorized attacker with network access to elevate privileges. Exploitation would give the attacker higher rights on the target system, potentially enabling further malicious actions such as installing malware, accessing sensitive data, or moving laterally within the network.

Affected Windows and Windows Server products include Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 24H2, 25H2 and 26H1, as well as Windows Server 2012 R2, 2016, 2019, 2022 and 2025. The problem is present across the listed releases; newer releases beyond those versions have not been reported as affected.

The CVSS score of 8.8 indicates a high severity if the flaw is successfully exploited. The EPSS score of less than 1 % suggests the likelihood of exploitation is currently low, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need network connectivity to the target and would most likely target sessions handled by Remote Access Connection Manager, an authorized user channel. The use‑after‑free weakness implies an attacker can trigger unintended memory access, creating the conditions for privilege escalation. Given the high impact and the remote access vector, systems should treat this as a serious risk even if exploitation evidence is limited.