The vulnerability is an out‑of‑bounds read in Windows Routing and Remote Access Service (RRAS). An attacker who can send crafted packets or commands to the service may cause it to read memory beyond intended bounds, allowing disclosure of information that should be protected. The flaw does not provide arbitrary code execution, but it does expose sensitive system data and can be used to aid further attacks by revealing configuration details or memory contents.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 (ARM64 and x64 variants), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both standard and Server Core installations). The flaw exists when the RRAS service is running on any of these operating systems.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is 1%, indicating a very low but non‑zero probability of exploitation, and it is not listed in CISA’s KEV catalog, suggesting no confirmed active exploitation. The likely attack vector is over the network via RRAS, meaning an attacker who can reach the device’s RRAS endpoint could trigger the read and extract data. The absence of code execution limits the impact to data leakage, but the knowledge of system internals could aid further attacks.