The vulnerability in Windows Routing and Remote Access Service (RRAS) permits an attacker to execute arbitrary code on a target system. The flaw stems from improper handling of memory and signed arithmetic, as indicated by CWE-122 and CWE-191. Successful exploitation could grant the attacker full control over the victim machine, enabling data theft, persistence, or further lateral movement.

Products affected include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations). These encompass both x86 and x64 platforms, as well as ARM64 for certain Windows 11 releases.

The CVSS score of 8.8 signals a high severity. EPSS information is not available, meaning the probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access via the RRAS service when it is enabled and accessible over a network. An attacker would need network reach to the RRAS server and would exploit the memory corruption flaw to run code with the privileges of the RRAS service.