Windows RasMan CVE-2026-85867

Exploitation requires the attacker to already have local, authenticated access to the target host with at least low-privilege (standard user) rights (AV:L, PR:L) - there is no network-facing or unauthenticated path. No user interaction is needed (UI:N), and the flaw is reachable against default configurations because the Remote Access Connection Manager (RasMan) service is a standard Windows component present on all affected editions (Windows 10/11 across 1607 through 26H2, and Windows Server 2012 R2 through 2025). The primary limiting factors are: (1) the attacker must first obtain a local foothold by other means; (2) SSVC rates the attack as non-automatable, implying heap grooming / reliability work rather than trivial one-shot exploitation; and (3) only builds below the patched versions listed in EUVD (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761) are vulnerable.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a local privilege-escalation flaw requiring an attacker to already have low-privileged authenticated access to the host; it is not remotely exploitable. The high 7.8 base score is driven entirely by total impact (C:H/I:H/A:H), consistent with SSVC Technical Impact: total - successful exploitation yields SYSTEM-level control. However, several signals point to lower real-world urgency: SSVC Exploitation is 'none' and Automatable is 'no' (RasMan privilege escalation is not a mass-scannable, wormable condition), no CISA KEV listing applies, and no public exploit code is identified. There is no EPSS score in the provided data, so exploitation probability cannot be quantified - do not assume it is low or high. The signals are internally consistent (local vector + low automatability + no known exploitation all align), so there is no contradiction to flag; the main caveat is simply that this is one of many Windows LPE bugs that are valuable as a post-compromise step but do not enable initial access on their own. Prioritize via normal Patch Tuesday cadence, raising urgency where low-privilege or multi-tenant users share hosts.

An attacker who has already gained an unprivileged foothold on a Windows host - for example via phishing, a stolen standard-user credential, or a separate initial-access bug - runs a crafted local program that interacts with the Remote Access Connection Manager (RasMan) service to trigger a heap-based buffer overflow. By grooming the heap and corrupting memory, they escalate from their low-privileged context to SYSTEM, gaining full control of the machine. No public exploit is identified at time of analysis, so a working technique would need to be developed or obtained.