EUVD-2026-99755
GHSA-wfg8-9jh5-73rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach RRAS endpoint over network
-
ExploitSend crafted RRAS request
-
ExecutionTrigger out-of-bounds read
-
ImpactLeak process memory over network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Windows host to have the Routing and Remote Access Service (RRAS) role installed and running and reachable on the network - RRAS is not enabled by default on either Windows Server or Windows client SKUs, so hosts without this role configured (typically VPN/dial-up/NAT routing servers) are not exposed. Where RRAS is enabled, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed. The practical limiting factor is therefore the non-default RRAS deployment and network exposure of that service, not attacker privilege; impact is confined to information disclosure (read-only) with no integrity or availability effect. |
| Impact | Signals are consistent and point to a real but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated vector, and C:H/I:N/A:N correctly reflects a pure information-disclosure impact with no integrity or availability loss - matching the CWE-125 out-of-bounds read. CISA's SSVC framing agrees: Exploitation=none (no observed attacks), Automatable=yes (reflecting the unauthenticated network vector, meaning it could be scanned/sprayed at scale), and Technical Impact=partial (consistent with read-only disclosure rather than full compromise). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. KEV status is not listed and no POC is referenced, so this is not confirmed exploited and no public exploit is known. The main mitigating factor absent from the raw CVSS score is that RRAS is an optional, non-default role - the 7.5 score assumes the vulnerable service is actually running and network-exposed. Net: a legitimately patch-worthy unauthenticated disclosure bug, but a tier below code-execution flaws given read-only impact and the lack of exploitation evidence. |
| Exploit ScenarioDerived | An attacker with network reachability to a Windows host that has the Routing and Remote Access Service role enabled (e.g. a VPN/routing gateway) sends a crafted request to the RRAS endpoint, triggering an out-of-bounds read. The service returns memory contents beyond the intended buffer, leaking potentially sensitive process memory back over the network. No authentication or user interaction is required, but no public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
RemediationAI
Apply the Microsoft security update for CVE-2026-96245 as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96245; patch status is 'available from vendor' per the input data, with fixed build thresholds per the EUVD affected-version ranges (for example 10.0.14393.9612 for Windows 10 1607/Server 2016, 10.0.17763.9376 for Windows 10 1809/Server 2019, 10.0.22631.7652 for Windows 11 23H2, and 10.0.26100.33650 for Windows Server 2025) - treat those numbers as the release targets indicated by the vendor's version data rather than independently verified KB identifiers. Prioritize internet-facing RRAS hosts (VPN gateways, RAS/NAT routers) since those are the only systems exposed, but note that no public exploit code was identified at time of analysis, so normal-cycle patching is reasonable for internal-only deployments. Where patching must be deferred, the most effective compensating control is to stop and disable the Routing and Remote Access Service (RemoteAccess) on any server that does not require VPN, dial-up or NAT routing - the trade-off is complete loss of those functions, so it is only suitable for hosts where RRAS was enabled incidentally. For hosts that must keep RRAS running, restrict network reachability of the RRAS listener with host firewall rules and perimeter ACLs that allow only known VPN client ranges or site-to-site peer addresses, and block inbound access to remote-access protocol ports (PPTP TCP 1723 and GRE, L2TP UDP 1701, IKEv2/IPsec UDP 500 and 4500, SSTP TCP 443) from untrusted networks - this reduces the attack surface but does not eliminate the flaw for legitimate clients, and blocking those ports will break VPN connectivity for any user outside the permitted ranges. Note that because the defect is a read-only information disclosure, integrity- and availability-focused controls such as malware detection will not reliably flag exploitation; monitor RRAS service crashes or anomalous memory-disclosure indicators where logging is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic out-of-bounds read (CWE-125) in the Windows Routing and Remote Access Service, Microsoft's built-in multiprotocol routing, remote-access and VPN service. RRAS implements remote-access protocols such as PPTP, L2TP/IPsec, SSTP, IKEv2, and dial-up/RAS, plus LAN routing, demand-dial and NAT functionality; network-facing packet parsing in that stack is the likely locus of the defect, where a length or offset field in a crafted request is trusted without adequate validation against the actual buffer size, causing the service to read memory beyond the intended allocation. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the attack is remote, low complexity, requires no authentication and no user interaction, and that the resulting impact is disclosure of memory contents only - no write primitive, no denial of service and no scope change are described. Because the leaked data may include adjacent heap contents, the practical severity depends on what secrets happen to be resident near the vulnerable buffer, which is why only Confidentiality is rated High. Version data from ENISA EUVD maps the fix boundaries to specific Windows builds across Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, indicating a shared RRAS codebase across client and server SKUs.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable RRAS service (AV:N/AC:L/PR:N/UI:N); out-of-bounds read discloses memory so C:H, with no write or crash impact (I:N/A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
A high-severity information disclosure vulnerability in Windows Routing and Remote Access Service (RRAS) affects only organizations that run the RRAS role on network-reachable servers, such as VPN, dial-up, or NAT gateways. An attacker who can reach the service could read sensitive memory contents, potentially exposing credentials or configuration data, but no public exploit identified at time of analysis and patch available per vendor advisory. Leadership should prioritize patching these edge systems because they often sit at trust boundaries and any data leak could aid further intrusion.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB