Windows Remote Access Connection Manager contains a heap-based buffer overflow that can be triggered by an authorized user to gain higher privileges on the same machine. Because the flaw resides in memory handling, an attacker could supply a crafted input that overwrites control data and causes the system to execute arbitrary code with the privileges of the current user. This results in local privilege escalation, allowing the attacker to perform administrative actions, install malware, or pivot to other systems.

The vulnerability affects Microsoft Windows 10 through version 22H2, Windows 11 through versions 23H2, 24H2, 25H2, 26H2, and 26H1, and Windows Server from 2012 R2 up to 2025, including both full and Server Core editions.

With a CVSS score of 7.8 the flaw is considered serious, but it requires an attacker to already have access to the target machine as a non‑administrator user. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Even so, local privilege escalation remains a high risk for systems that use Remote Access Connection Manager and could be leveraged to compromise the entire machine or to move laterally within an environment.