Windows RRAS CVE-2026-84020

Exploitation requires that the Routing and Remote Access Service (RRAS) role/feature is installed and running on the target Windows host - RRAS is not enabled by default on client or server SKUs, so hosts configured as VPN/NAT/routing gateways are the realistic targets. The attacker must additionally have valid local authenticated access with at least low privileges (PR:L) and the ability to execute code or interact with the service locally (AV:L); there is no remote or unauthenticated path. Realistic exploitation is further limited by high attack complexity (AC:H): the use-after-free is a race condition requiring the attacker to reliably win a timing window and reclaim the freed object, which SSVC assesses as not automatable. These factors - RRAS being a non-default role, mandatory local authentication, and race-dependent exploitation - meaningfully constrain real-world risk below what the 7.0 score alone implies.

This is a moderate-priority, not emergency, vulnerability. The CVSS 3.1 base score of 7.0 (High) is tempered by its vector: AV:L means no remote reachability - the attacker must already execute code on the host; AC:H reflects the race-condition nature of a use-after-free (CWE-416), which is non-deterministic and often requires precise timing to win; PR:L confirms the attacker must already be an authenticated (low-privilege) local user. The SSVC decision framework reinforces a lower real-world urgency: Exploitation = none (no observed activity), Automatable = no (consistent with AC:H, not a point-and-click mass-exploitation primitive), though Technical Impact = total aligns with the C:H/I:H/A:H full-SYSTEM-compromise outcome of a successful privilege escalation. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a high-impact-but-conditional local EoP rather than a widespread, weaponized threat. No signals conflict: CVSS (local, authenticated, high-complexity), SSVC (not automatable, no exploitation), and the absence of KEV/POC all consistently point to a vulnerability worth patching in the normal Patch Tuesday cycle rather than out-of-band. Note the input Tags include 'Denial Of Service' while the description and CVSS (I:H) describe privilege elevation; the UAF could plausibly manifest as either, but the authoritative impact is local EoP.

A low-privileged authenticated user who already has local access to a Windows host running the Routing and Remote Access Service triggers a use-after-free condition in RRAS by exercising a specific operation sequence, winning a timing/race window to reclaim the freed object with attacker-controlled data. Successful exploitation elevates the user to SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact on the machine. No public exploit code has been identified, and the high attack complexity (AC:H) makes reliable exploitation non-trivial.