EUVD-2025-17774Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
AnalysisAI
Heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS) that allows authenticated network attackers to execute arbitrary code with high impact on confidentiality, integrity, and availability. This is a critical vulnerability affecting RRAS implementations across Windows Server and client operating systems; exploitation requires valid credentials but no user interaction, making it suitable for lateral movement and privilege escalation scenarios within compromised networks.
Technical ContextAI
The vulnerability exists in the Windows Routing and Remote Access Service (RRAS), a core Windows networking component responsible for managing dial-up, VPN, and routing connections. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), indicating improper bounds checking when writing to dynamically allocated heap memory within RRAS protocol handlers. This likely occurs during processing of remote access protocol messages (potentially PPP, SSTP, L2TP, or IKEv2 implementations). The heap overflow allows attackers to corrupt adjacent heap structures, potentially achieving code execution through heap spray techniques or return-oriented programming (ROP) chains. Affected systems include Windows Server (2016, 2019, 2022) and client versions (Windows 10, Windows 11) with RRAS enabled, correlating to CPE patterns like 'cpe:2.3:o:microsoft:windows_server:*' and 'cpe:2.3:o:microsoft:windows:*' where RRAS is active.
RemediationAI
Immediate actions: (1) Apply the latest Microsoft security patch for Windows/Windows Server as released by Microsoft (expected in regular or out-of-band security updates); (2) If patches are unavailable, implement network-level mitigations: restrict access to RRAS ports (typically UDP 500, 1194, 1701, 443 for VPN protocols) using firewall rules; restrict RRAS access to trusted source IP ranges; (3) Disable RRAS on systems where it is not required; (4) Enable strong authentication (MFA/2FA) on VPN and remote access endpoints to reduce credential compromise risk; (5) Monitor RRAS logs for suspicious protocol messages and unexpected connection attempts; (6) Implement network segmentation to isolate RRAS infrastructure. Check Microsoft Security Update Guide (https://msrc.microsoft.com) and Windows Server Security Updates for specific KB articles and patch versions. Vendor advisories will provide definitive remediation guidance with specific build numbers.
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today