Heap-Based Buffer Overflow in Microsoft Windows RRAS Enables Remote Code Execution

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

• Windows 10 Version 1607: from 10.0.14393.0 to less than 10.0.14393.9512.
• Windows Server 2016, including Server Core installation: from 10.0.14393.0 to less than 10.0.14393.9512.
• Windows 10 Version 1809: from 10.0.17763.0 to less than 10.0.17763.9245.
• Windows Server 2019, including Server Core installation: from 10.0.17763.0 to less than 10.0.17763.9245.
• Windows 10 Version 21H2: from 10.0.19044.0 to less than 10.0.19044.7725.
• Windows 10 Version 22H2: from 10.0.19045.0 to less than 10.0.19045.7725.
• Windows 11 Version 23H2: from 10.0.22631.0 to less than 10.0.22631.7582. The record lists this branch twice with the same boundary.
• Windows 11 Version 24H2: from 10.0.26100.0 to less than 10.0.26100.9445.
• Windows 11 Version 25H2: from 10.0.26200.0 to less than 10.0.26200.9445.
• Windows 11 version 26H1: from 10.0.28000.0 to less than 10.0.28000.2954.
• Windows Server 2012, including Server Core installation: from 6.2.9200.0 to less than 6.2.9200.26349.
• Windows Server 2012 R2, including Server Core installation: from 6.3.9600.0 to less than 6.3.9600.23397.
• Windows Server 2022: from 10.0.20348.0 to less than 10.0.20348.5622.
• Windows Server 2025, including Server Core installation: from 10.0.26100.0 to less than 10.0.26100.33438.

These are the boundaries confirmed by the record. The status of unlisted branches or variants should not be inferred from this list.

Microsoft Windows Routing and Remote Access Service (RRAS) contains a heap-based buffer overflow, classified as CWE-122. The vulnerable component is RRAS, but the record does not identify the exact routine, protocol, data field, or message that causes the overflow, so the specific attacker-controlled input cannot be confirmed. The record describes network reachability and no user interaction. The privilege precondition is inconsistent across the supplied assessments: Microsoft records low privileges required, while the NVD assessment records no privileges required. Successful exploitation could result in remote code execution and unauthorized access to the affected machine.

• Reachability: The record describes network-based exploitation.
• Authentication and privileges: Unresolved. Microsoft records low privileges required, while NVD records no privileges required.
• User interaction: None is required according to the record.
• Complexity: Described as low in the assessments included in the record.
• Exploitation status: The record marks public_exploit as false but does not establish whether exploitation has occurred in the wild. The known_exploited field has no value, and no named campaign, victim, or exploit is identified.

The flaw could allow remote code execution in the context of RRAS, leading to unauthorized access to the affected machine. Potential technical consequences include reading data, changing system state or configuration, and disrupting networking or remote-access services; the actual result depends on the host's role. The record does not identify the process context, post-exploitation privilege level, lateral-movement capability, or any additional post-exploitation requirement. The supplied assessments do not indicate a scope change, but they do not replace validation of the deployed configuration.

A compromised RRAS system could provide unauthorized control over a machine that supports routing or remote-access functions. Depending on the host's role, an attacker could potentially read data, change configuration, or disrupt services, but the record does not confirm a specific post-exploitation scenario. If RRAS supports remote access infrastructure, compromise could increase the risk of connectivity disruption or interfere with administration. The record does not identify a breach, victim, or campaign.

1. Install Microsoft's security update for the Windows branch in use. The record confirms that a patch is available but does not provide an alternative mitigation.
2. Compare the post-update build with the applicable boundary recorded for the branch:

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9512.
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9245.
• Windows 10 Version 21H2: 10.0.19044.7725.
• Windows 10 Version 22H2: 10.0.19045.7725.
• Windows 11 Version 23H2: 10.0.22631.7582.
• Windows 11 Version 24H2: 10.0.26100.9445.
• Windows 11 Version 25H2: 10.0.26200.9445.
• Windows 11 version 26H1: 10.0.28000.2954.
• Windows Server 2012: 6.2.9200.26349.
• Windows Server 2012 R2: 6.3.9600.23397.
• Windows Server 2022: 10.0.20348.5622.
• Windows Server 2025: 10.0.26100.33438.

1. Check Server Core installations separately because the record identifies them as affected variants for several server branches.
2. If immediate patching is not possible, reduce RRAS exposure to untrusted networks using approved organizational network controls. The record does not confirm a specific disablement setting or filtering rule, so an unverified configuration change should not be treated as a substitute for the patch.
3. Validate remediation through asset inventory and build checks. Do not infer that other Windows branches are unaffected merely because they are not included in the supplied boundaries.

1. Inventory Windows systems that install or use Routing and Remote Access Service (RRAS), including Server Core installations.
2. Compare each host's operating system build with the exact product branch listed as affected. Do not treat the absence of an obvious RRAS role as proof of safety until the deployed configuration has been checked.
3. Prioritize review of RRAS systems that accept connections from untrusted networks or from broader network segments than intended.
4. As a precaution, review network, service, and process telemetry for unusual behavior after remote connections are received. This is supplemental monitoring, not a vendor-confirmed indicator.
5. The record provides no IOC, specific event ID, or distinctive traffic pattern. Lack of relevant log evidence does not prove that a system is unaffected or was not exploited.