Null pointer dereference in the Windows Routing and Remote Access Service (RRAS) causes the RRAS process to crash. An unauthorized attacker can trigger this flaw over a network, a conclusion inferred from the description, resulting in denial of routing or VPN services for users until the service is restarted.

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2 through 26H2 (including 26H1); and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, for both full and Server Core installations.

The CVSS score of 7.5 reflects a high severity impact with medium to high exploitation potential. The EPSS score of 1% suggests a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been confirmed. Attackers can exploit the flaw remotely over a network without needing local privileges, making it a notable threat for services exposing RRAS to untrusted networks. Mitigation requires applying the vendor security update or disabling the RRAS service if it is not essential.