The vulnerability is a Use‑After‑Free flaw in the Windows Routing and Remote Access Service (RRAS) that allows an attacker to execute arbitrary code on the target system without authentication. The flaw can be triggered by sending specially crafted packets or requests to the RRAS service, which then releases a freed memory block that the attacker can reuse for malicious payloads. Successful exploitation grants the attacker full system control, leading to data theft, installation of malware, or further lateral movement.

Affected Microsoft products include the Windows 10 family (versions 1607, 1809, 21H2, 22H2), the Windows 11 family (versions 23H2, 24H2, 25H2, 26H2, 26H1), and a range of Windows Server releases (2012, 2012 R2, 2016, 2019, 2022, 2025), including their Server Core installations. Any system running the RRAS role and exposed to the network is potentially vulnerable.

The CVSS score of 9.8 marks this flaw as critical, and it is not listed in the CISA KEV catalog; no EPSS figure is available, so the likelihood of exploitation is unknown. The description suggests the vulnerability can be triggered remotely over the network and does not require local privilege or user interaction; based on this, it is inferred that the attack vector is remote exploitation of the RRAS service on exposed systems.