An integer overflow in the Windows Remote Access Service Infrastructure causes the service to incorrectly process numeric values from network traffic. When the overflow occurs, the service can execute privileged code paths that grant the attacker higher privileges than the current user account. The flaw is identified as CWE-190 and can allow an attacker with network access to a vulnerable host to elevate privileges from a regular user level to system or higher.

Affected versions include Microsoft Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2012‑R2, 2016, 2019, 2022, 2025. Both standard and Server Core editions are impacted, with support for 32‑bit, 64‑bit, and ARM64 builds depending on the release.

The CVSS score of 8.8 indicates a high severity privilege‑escalation vulnerability. The EPSS score of less than 1 % suggests a low probability of widespread exploitation as of the data available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can reach the Windows Remote Access Service Infrastructure from a network and send crafted packets that trigger the overflow, meaning it is exploitable from within the same network or from a compromised host that has network connectivity to the vulnerable device.