The vulnerability arises from the use of an uninitialized resource within Windows Routing and Remote Access Service (RRAS). An attacker without prior authentication can trigger a response that reveals sensitive data over the network. This flaw provides an information disclosure risk, potentially exposing system configuration or other confidential information to parties that can reach the RRAS service. The weakness corresponds to the CWE‑908 category, reflecting improper handling of an uninitialized resource.

Affected systems include multiple Microsoft Windows client and server releases. Client editions comprise Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 editions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions span Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, each in both full and Server Core installations where applicable. All these environments host the RRAS component and are susceptible before the release of the security update.

The vulnerability carries a CVSS score of 7.5, indicating a high severity level. EPSS score of 1% indicates a low but non‑zero exploitation probability, and the flaw is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. The likely attack vector is remote over a network connection to the RRAS service, and no special privileges are required for exploitation. Although no exploit code is publicly disclosed, practitioners should treat this as a significant risk until the update is applied.