Windows CVE-2025-33066

CVSS 8.8 (High/Critical) with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network accessibility, low attack complexity, no privilege requirements, but requires user interaction—a key limiting factor. The user interaction (UI:R) requirement suggests the attack may require a user to click a link, open a file, or initiate a connection, reducing real-world exploitation probability compared to a fully unauthenticated remote code execution. Without access to EPSS data, KEV catalog status, or proof-of-concept availability, the true exploitation probability cannot be definitively assessed, but the network attack vector and lack of authentication requirements place this in the critical priority tier IF actively exploited or if POC is public. If this is not yet in the KEV catalog or widely exploited, the UI requirement may reduce urgency relative to other network RCE vulnerabilities. SSVC perspective: if exploitation is unproven/unreported, automatable exploitation is uncertain (heap layout randomization may complicate reliable RCE), and technical impact is high (code execution), this warrants prompt patching but not emergency response unless KEV-confirmed.

An attacker sends a specially crafted RRAS protocol request (e.g., via VPN connection attempt, routing configuration packet, or authentication frame) to a target Windows system running RRAS on port 443 or 1723. The RRAS service fails to validate the input length and writes the attacker's payload beyond the allocated buffer boundary. This overflow corrupts heap metadata or function pointers, allowing the attacker to gain code execution. If the RRAS service runs as SYSTEM (typical), the attacker gains full system access, enabling lateral movement, persistence, and data exfiltration. The UI:R requirement suggests the attack may require a user to initiate or accept a connection (e.g., an employee clicking a malicious VPN link), though depending on the specific protocol vulnerability, this requirement may be bypassable via continuous connection attempts. For example, an attacker could host a rogue RRAS server and trick users into connecting, or exploit pre-authentication RRAS protocol handling. If POC exists for reliable heap layout control (de-randomization or heap spray), this becomes a high-probability RCE.