Windows RasMan CVE-2025-62472

Requires the attacker to already have local, interactive or programmatic access to the target Windows host as an authenticated low-privileged user (PR:L, AV:L) - there is no remote or network-triggerable path. Exploitation hinges on reaching the vulnerable code in the Remote Access Connection Manager (RasMan) service, which is present and running by default across supported Windows client and server editions, so no special non-default configuration is needed beyond the RasMan service being active. No user interaction by a separate victim is required (UI:N). The primary limiting factor is the prerequisite of prior code execution/logon on the machine, which confines this to post-compromise privilege escalation rather than initial access.

This is a genuine but second-tier priority: a local elevation-of-privilege flaw in the Windows Remote Access Connection Manager (RasMan) service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description - local vector, low complexity, and an already-authenticated low-privileged attacker gaining full CIA impact (SYSTEM-level EOP). It is NOT a remote or unauthenticated issue, so it is not a perimeter-breach vulnerability; it is a post-compromise privilege-escalation primitive. The EPSS score of 2.20% (82nd percentile) is notably elevated for a local-only bug and above the typical Patch-Tuesday EOP baseline, suggesting the scoring model sees meaningful exploitation potential - consistent with RasMan/EOP bugs being historically favored in exploit chains - but it still falls far short of imminent-exploitation territory. There is no CISA KEV listing and no public POC identified at time of analysis, so exploitation is at most anticipated, not observed. One data conflict worth flagging: the description states 'use of uninitialized resource' (behaviorally CWE-908) while the assigned CWE is CWE-416 (use-after-free) and the 'Use After Free' tag echoes that - verify the precise root cause with Microsoft, though it does not change the priority. Bottom line: a real, patch-on-cycle EOP rather than a drop-everything emergency, because it requires prior local code execution.

An attacker who already has a foothold on a Windows host as a standard (low-privileged) user - for example via phishing-delivered malware or a compromised service account - invokes the Remote Access Connection Manager in a way that triggers use of an uninitialized/freed resource. By controlling the contents of that memory, they corrupt kernel or service state to execute code in the SYSTEM context, completing local privilege escalation. No public exploit code has been identified at time of analysis, and the attack requires local access and low-complexity interaction with RasMan.