This vulnerability involves an integer overflow or wraparound condition within the Windows Routing and Remote Access Service (RRAS) component of Windows 10 Version 1607 (build 10.0.14393.0). Exploitation requires an attacker to have some level of authorization and user interaction, but it enables remote code execution over the network. The vulnerability is tracked as CVE-2026-25172 and is assigned a high CVSS 3.1 base score of 8.0, reflecting its potential impact on confidentiality, integrity, and availability. Microsoft has released an official fix to remediate this issue.

Successful exploitation of this vulnerability can lead to remote code execution by an authorized attacker, potentially resulting in full compromise of the affected system's confidentiality, integrity, and availability. The attacker must have some privileges and user interaction is required, but the network attack vector increases the risk of remote exploitation.

An official patch is available from Microsoft to address this vulnerability. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25172 to remediate the issue. Since the patch is officially released, applying it is the recommended mitigation.