The Windows Routing and Remote Access Service (RRAS) flaw permits an attacker to execute arbitrary code on the affected system, granting full unauthorized control. The vulnerability stems from a buffer overflow (CWE‑122) due to improper input validation within RRAS, enabling attackers to compromise system confidentiality, integrity, and availability by running malicious code or disrupting services.

Microsoft Windows 10 versions 1607 through 22H2, Microsoft Windows 11 versions 23H2 through 26H2, and Microsoft Windows Server releases 2012 through 2025—including both standard and Core installations—are vulnerable when the RRAS feature is enabled.

The CVSS v3.1 base score of 9.8 classifies this flaw as Critical, but no EPSS value is published, so the exact exploitation probability is unknown; it is also absent from the CISA KEV list, indicating no documented exploits yet. Because RRAS listens for network connections, the likely attack vector is remote over the network, allowing an adversary who can reach the RRAS port to trigger the buffer overflow and achieve code execution without local user interaction.