A use‑after‑free flaw exists in the Windows Routing and Remote Access Service (RRAS). The bug can be triggered by an authorized attacker, resulting in elevation of privileges on the local system. The weakness is classified as CWE-416 and offers the attacker the ability to execute code with higher privileges than their current account.

Affected products include Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 Version 26H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2022, Microsoft Windows Server 2025, and Microsoft Windows Server 2025 (Server Core installation). All listed versions are impacted.

The CVSS score for this vulnerability is 7.0, indicating a high severity of privilege escalation. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog at this time. Attackers would need local or remote authorized access to the RRAS component; the flaw is not exploitable by unauthenticated users. Successful exploitation would permit an attacker to gain system‑level privileges on the affected host.