Windows RRAS CVE-2025-62473

Requires the target Windows host to have the Routing and Remote Access Service (RRAS) role enabled - this is an optional networking/VPN role that is NOT installed or active by default on Windows client or server SKUs, which sharply narrows the exposed population. The CVSS UI:R further indicates exploitation depends on victim-side interaction (the RRAS/VPN host connecting to or processing attacker-supplied traffic, e.g. reaching a malicious endpoint), not a fully passive server-side hit. Impact is limited to information disclosure only (C:H, I:N, A:N): no code execution, data tampering, or denial of service results directly. Affected platforms span Windows 10 1607 through Windows 11 25H2 and Windows Server 2008 SP2 through Server 2025.

Moderate, non-urgent priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N = 6.5) describes a network, unauthenticated, low-complexity buffer over-read that leaks information (C:H) but cannot alter data or affect availability (I:N/A:N). The critical nuance is UI:R: despite AV:N, exploitation is not server-side drive-by - a Windows RRAS/VPN host must interact, consistent with the victim connecting to or processing responses from an attacker-controlled RRAS/VPN endpoint. EPSS is 1.08% (64th percentile), which is modestly elevated but not indicative of imminent mass exploitation. There is no CISA KEV listing and no public exploit code, so this is 'no public exploit identified at time of analysis' rather than active exploitation. No SSVC decision data was provided. Net: a real but bounded read-only information-disclosure issue gated by the optional RRAS role and required interaction - patch on the normal Patch-Tuesday cycle, prioritizing hosts that actually run RRAS.

An attacker stands up a malicious RRAS/VPN endpoint (or injects crafted routing/VPN protocol responses) and induces a Windows host running RRAS to connect or process the traffic. A malformed structure triggers an out-of-bounds read in the RRAS parser, returning adjacent memory contents - potentially session data, pointers, or configuration fragments - back over the network to the attacker. No public proof-of-concept is available at time of analysis.