Windows RRAS EUVD-2026-44259

Exploitation requires that the target run the Windows Remote Access Service (RRAS) Infrastructure, and that the attacker already hold low-level authenticated privileges (PR:L) with network reachability (AV:N) to the service; no user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must first authenticate or otherwise possess a valid low-privilege account, and the vulnerable component must be present and enabled - hosts where RRAS/Routing and Remote Access is not configured do not expose the affected code path. This positions the flaw as a post-authentication privilege-escalation vector rather than a fully unauthenticated remote compromise.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 8.8, High) describes a network-reachable attack of low complexity requiring low privileges, no user interaction, and full high impact to confidentiality, integrity, and availability without scope change - a strong signal for prioritization. Countervailing signals temper this: no EPSS score, KEV status, or SSVC decision data was provided, and there is no public exploit identified at time of analysis, so exploitation is not confirmed to be occurring or trivial in practice. The PR:L requirement means an attacker must already hold some authenticated foothold, which limits pure unauthenticated internet exposure and points toward post-compromise privilege escalation rather than mass exploitation. Overall this is a genuine priority for systems running RRAS due to the impact profile and ubiquity of the platform, but the absence of EPSS/KEV data means the real-world exploitation likelihood cannot be quantified from the provided inputs.

An attacker who has obtained a low-privileged authenticated foothold on a network reachable to an affected Windows host sends crafted input to the RRAS infrastructure that drives an arithmetic value past its integer bound. The resulting undersized allocation and memory corruption let the attacker elevate to a higher privilege context on the target. No public proof-of-concept is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required once access is obtained.