The CVSS 8.1 rating on this SSTP double-free is misleading, and the EPSS score of 0.00572 confirms what the severity alone doesn't tell you: this is a narrow, specialized exploitation path, not a drop-everything finding. The description's use of 'unauthorized attacker' is the critical detail. This language almost always signals a client-side trigger—a victim must connect to a malicious SSTP server to trigger the double free, rather than an attacker compromising a server directly. That changes the operational profile entirely.
If the double free triggers on the SSTP client during connection negotiation, you're looking at remote code execution on endpoints that may already have elevated network trust through VPN credentials. That matters for your blast radius calculation: a compromised laptop with domain-joined status can be a pivot point to domain controllers, file servers, and other high-value targets. The vulnerability isn't just about the endpoint—it's about what that endpoint can reach.
One concrete gap in the CVE: the CVSS vector shows Network attack complexity, but if exploitation requires a user to explicitly connect to a malicious SSTP server, this should likely be Adjacent or even require User Interaction. That mismatch is either a description underspecification or an incorrect vector—and that ambiguity is where your real risk calculation lives.
The EPSS score likely reflects SSTP's niche status more than exploit difficulty. The protocol was a firewall-punching workaround built on HTTPS, largely superseded by IKEv2 in modern enterprises. If your organization still runs SSTP VPN concentrators, the exposure is real but conditional on attacker-controlled infrastructure. If you've moved to IKEv2 or modern alternatives, this lives in the vestigial code layer that runs by default on every Windows desktop but no one actively maintains or monitors.
For defenders: confirm whether SSTP is actually in your environment, prioritize patching endpoints that use SSTP VPN clients over servers (the client-side trigger is the more plausible path), and treat any compromise of an SSTP-connected endpoint as a potential domain pivot given the trust model.