Windows RRAS CVE-2026-71351

Exploitation requires an attacker to already hold a valid, low-privileged local account or active local session on the target Windows system (PR:L, AV:L). The Routing and Remote Access Service must be installed and running - RRAS is not enabled by default on standard workstations or minimal server builds and must be explicitly configured by an administrator for VPN, dial-up, or routing scenarios. Attack complexity is high (AC:H), meaning reliable exploitation demands precise heap manipulation or race-condition timing that is not trivially achievable. No user interaction is required once the attacker has local access. Exploitation is limited to the local system; remote unauthenticated exploitation is not supported by the CVSS vector.

The provided CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures the threat model: local access with low privileges is required, but exploitation is complex. Real-world risk is moderated by several factors: RRAS must be installed and running (not a default configuration on workstations or minimal server builds), the attacker must already have a local foothold with at least standard user privileges, and the AC:H constraint means reliable exploitation likely demands significant reverse-engineering effort or heap-grooming techniques. No EPSS score, no CISA KEV listing, and no POC are present in the available data, further supporting a prioritization below actively exploited local EoP bugs. That said, the C:H/I:H/A:H impact cluster means a successful exploit delivers full system compromise. Organizations running RRAS as a VPN or routing gateway - where RRAS is necessarily enabled - face elevated risk from insider threats or post-breach lateral movement.

An attacker who has already obtained a low-privileged user account on a Windows Server running RRAS - for example, through a phishing-delivered payload or compromised service account - crafts a sequence of requests or API calls to the RRAS service designed to trigger the double-free condition after careful heap grooming. After multiple attempts to satisfy the AC:H timing or state requirements, the attacker achieves arbitrary code execution in the RRAS process context and escalates from a standard user to SYSTEM. No public exploit code has been confirmed in available data.