EUVD-2026-72979
GHSA-9wfg-4cq2-rjx6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local service exploit requiring authenticated user session; PR:L reflects minimum foothold; full C/I/A consistent with SYSTEM-level escalation via heap corruption.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session on the target Windows system with at minimum standard (low-privilege) user rights, consistent with CVSS PR:L and AV:L - remote-only access without existing code execution cannot trigger this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a reliable local privilege escalation: low complexity, no interaction, and full system impact once a minimal foothold exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update via Windows Update or WSUS, targeting the patched build for each affected SKU: Windows 10 1607 and Server 2016 → build 10.0.14393.9512; Windows 10 1809 and Server 2019 → 10.0.17763.9245; Windows 10 21H2 → 10.0.19044.7725; Windows 10 22H2 → 10.0.19045.7725; Windows 11 23H2 → 10.0.22631.7582; Windows 11 24H2 and Server 2025 → 10.0.26100.9445 (desktop) / 10.0.26100.33438 (Server 2025); Windows 11 25H2 → 10.0.26200.9445; Windows 11 26H1 → 10.0.28000.2954; Server 2012 R2 → 6.3.9600.23397; Server 2022 → 10.0.20348.5622. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Windows 10 (1607 and later), Windows 11, and Windows Server (2012 R2-2025) systems in your infrastructure, prioritizing devices with broad local user access or exposed to untrusted users, and communicate the privilege escalation risk to system administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today