Out-of-bounds read within the Windows Routing and Remote Access Service (RRAS) allows an attacker who has local authorized access to read memory beyond its bounds, exposing sensitive data on the affected system. This is a buffer overread weakness classified as CWE‑125 and results in local disclosure of information. The impact is limited to the host machine and does not provide remote code execution or denial of service.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. All installations with the RRAS role enabled are vulnerable.

The CVSS score of 5.5 reflects a moderate severity. The EPSS score is very low (<1%) and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. Based on the description, the likely attack vector is local: an attacker must be authenticated on the machine and possess sufficient privileges to trigger the out‑of‑bounds read. Remote attackers lacking local access are unlikely to exploit this weakness, whereas any local user or script with appropriate rights poses a tangible risk of information exposure.