Windows RRAS CVE-2026-71353

Exploitation requires the attacker to hold a valid low-privileged account on the target machine (PR:L - domain user or local user) and have the ability to invoke RRAS service interfaces locally. The RRAS service (remoteaccess) must be present and running on the target; while present on most Windows installations, it is not active by default on all configurations. High attack complexity (AC:H) means reliable exploitation likely requires heap-grooming or race-condition triggering, which may depend on OS version, memory layout, or timing - limiting automated exploitation. No user interaction is required once local access is established. Remote unauthenticated exploitation is not possible given AV:L. The vulnerability does not require RRAS to be externally exposed or configured as a VPN/router endpoint - the flaw is in the local service component.

The CVSS base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes a moderate-to-high severity local privilege escalation. AV:L constrains the attack surface to users or processes already present on the target system, ruling out unauthenticated remote exploitation. AC:H further limits opportunistic exploitation - successful double-free exploitation typically requires precise heap-shaping, timing, or a race-condition trigger, making automated mass exploitation unlikely. PR:L means the attacker must already hold a low-privileged account (e.g., domain user or local user), reducing exposure in hardened environments with strict account provisioning. Despite high C/I/A values reflecting full post-exploitation impact, no public exploit code is known and the vulnerability is not listed in CISA KEV, consistent with a lower real-world exploitation rate at this time. The primary concern is targeted use by an insider threat or an attacker who has already gained a foothold via another vector. The wide affected-version spread (12+ distinct Windows release lines) increases aggregate exposure but does not change per-host risk. RRAS does not need to be actively configured as a VPN or router - the service component may be present even on systems not explicitly using remote access features, though defenders should confirm RRAS service state.

An attacker with a low-privileged local account on a Windows Server running RRAS crafts a sequence of RRAS API or IPC calls to trigger the double-free condition in the RRAS service process, grooming the heap to control the corrupted allocation. After achieving controlled memory write, the attacker overwrites a kernel structure or security token to escalate from a standard user to SYSTEM, gaining full control of the host. No public proof-of-concept exists at time of analysis; successful exploitation requires non-trivial heap manipulation skill.