Windows RRAS CVE-2026-57096

Exploitation requires the attacker to already have local, authenticated low-privileged access to the target (CVSS PR:L, AV:L) - this is a local elevation-of-privilege flaw, not remotely reachable, so it cannot be triggered across the network despite RRAS being a networking service. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once a local foothold exists the overflow can be triggered reliably against affected default installations without special timing or configuration. The limiting factors are the need for an existing local account/code execution and the presence of the RRAS/RemoteAccess service on the host; systems where RRAS is disabled or removed present no reachable attack surface for this specific issue.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a locally exploitable flaw of low complexity requiring an existing low-privileged foothold, with high confidentiality, integrity and availability impact and no scope change - consistent with a classic local elevation-of-privilege bug. No EPSS score or SSVC decision data was provided, so probability-of-exploitation and automatability cannot be quantified from the input. The vulnerability is not in CISA KEV and no POC was reported, so there is no evidence of active exploitation. Real-world priority is driven by the ubiquity of the affected Windows platforms and the reliability of the heap-overflow primitive rather than by any confirmed exploitation signal; because it requires local authenticated access, it is most relevant as a post-compromise escalation step rather than an initial-access vector. Note the local vector (AV:L) means this is not remotely exploitable despite RRAS being a networking service - verify whether the vulnerable code path is reachable only from local callers.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via phishing, a compromised service account, or a foothold on a shared server - invokes the vulnerable RRAS code path with crafted input that overflows a heap buffer. By controlling the heap corruption they overwrite adjacent objects to hijack execution and elevate from their limited account to SYSTEM. No public exploit is identified at time of analysis, and low attack complexity (AC:L) suggests a reliable exploit is feasible.