Windows Remote Access CVE-2026-62758

Exploitation requires the attacker to hold an existing low-privileged authenticated account on the target Windows system (PR:L) with local access - achieved via a physical console, RDP session, SSH, or an existing low-privilege remote shell. The Remote Access Connection Manager (RASMAN) service must be running, which is the default state on most Windows installations. No user interaction is required once the attacker triggers the overflow. Exploitation is strictly bounded to local vectors - a network-only attacker with no existing foothold cannot exploit this vulnerability directly. Attack complexity is rated Low, meaning no race conditions, specific timing windows, or non-default environmental configurations are required to trigger the overflow successfully.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a high-severity but post-exploitation primitive: an attacker must already possess an authenticated local session, making this most dangerous as a privilege escalation step after initial access rather than a standalone remote vector. The attack complexity of Low is a meaningful signal - it indicates no race conditions, memory grooming, or special environmental prerequisites are required, meaning once a foothold exists the escalation path is reliable. Even a mid-sized municipal IT team in legnica managing a mixed-generation Windows Server estate should treat this as an urgent patch cycle priority, particularly for terminal servers, RDP jump hosts, and shared infrastructure where low-privileged accounts are routinely issued. No EPSS score, CISA KEV listing, or public exploit code was included in the provided intelligence, so widespread opportunistic exploitation is not confirmed; however, the trivial attack complexity and enormous installed base mean weaponization risk is elevated as time passes without patching.

A low-privileged user with an RDP session on a Windows Server terminal host crafts a malformed request that triggers the heap-based buffer overflow in the RASMAN service, overwriting heap metadata or a function pointer to redirect execution. Because RASMAN runs with SYSTEM privileges, the attacker gains full control of the host, bypassing all user-mode restrictions. No public exploit code has been identified at time of analysis, but the Low attack complexity rating indicates the overflow is reliably triggerable without advanced heap-grooming techniques.