Remote Code Execution in Windows Routing and Remote Access Service (RRAS) caused by a double‑free flaw (CWE‑415). The vulnerability can allow an attacker to run arbitrary code on the target machine with privileges equal to the RRAS service, potentially granting full control of the system.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both full and Server Core installations.

The CVSS score of 8.8 classifies this as high severity, and the lack of a KEV listing suggests it is not currently being actively exploited in the wild. The EPSS score is not available, which is consistent with limited public exploitation data. Based on the description, the likely attack vector is an attacker who can reach the RRAS service over the network, such as a compromised workstation or malicious insider. Once the double‑free condition is triggered, arbitrary code can be run as the RRAS service account, compromising the host.