The vulnerability occurs when RRAS processes an improperly constructed network packet or configuration request, triggering an out-of-bounds read that corrupts application state and causes the service to crash. The crash results in a denial of connectivity for clients that rely on the routing and remote access service. The weakness is classified as CWE-125, an unsafe buffer read, which can be exploited without privileged access by anyone able to send traffic to the RRAS endpoint.

Affected products include Windows 10 1607, 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, as identified by the Microsoft product list and the associated Common Platform Enumeration strings. The vulnerability exists across both 32‑bit and 64‑bit builds, as well as ARM64 variants where applicable.

The CVSS score of 7.5 tags it as high severity, indicating a substantial impact if exploited. The EPSS score is 1%, indicating a low but non‑zero probability of exploitation; current evidence does not show it has entered the CISA KEV catalog or widespread exploitation remarks. The likely attack vector is remote over the network, with an attacker only needing to send a crafted request to the RRAS service. Because the vector relies on network traffic, it is accessible from any host that can reach the server, thereby elevating the risk to exposed infrastructure.