Windows EUVD-2025-17774

Despite the 8.8 CVSS score (High severity), this vulnerability presents a MODERATE-TO-HIGH real-world risk with important contextual nuances: (1) CVSS Attack Vector is Network (AV:N) and Complexity is Low (AC:L), enabling remote exploitation—strong indicators of practical exploitability; (2) Privilege Requirement is Low (PR:L), requiring authentication, which significantly reduces the attack surface compared to unauthenticated exploits but remains achievable via credential compromise, insider threats, or post-compromise lateral movement; (3) No User Interaction (UI:N) required strengthens the likelihood of automated exploitation; (4) The impact is Complete (C:H/I:H/A:H), affecting all three CIA pillars; (5) KEV and active exploitation status are critical unknowns—if this CVE is listed in CISA's Known Exploited Vulnerabilities catalog, risk escalates to CRITICAL; (6) EPSS probability, if available and >0.70, would indicate high real-world exploitation likelihood in the wild. The authentication requirement is both a mitigating factor and a realistic threat vector in enterprise environments with compromised accounts or VPN/dial-up access abuse. This should be treated as HIGH priority in network segmentation and access control assessments, particularly for organizations exposing RRAS to untrusted networks.

An attacker with valid VPN credentials (obtained through phishing, credential stuffing, or insider access) connects to a corporate RRAS VPN server. During the VPN handshake or tunnel establishment, the attacker sends a specially crafted remote access protocol message with an oversized payload designed to overflow the heap buffer in RRAS's protocol parsing routine. The overflow corrupts adjacent heap metadata or a function pointer on the heap. The attacker triggers a code path that dereferences the corrupted pointer, achieving arbitrary code execution in the context of the RRAS service (System/Local Service privileges). From this foothold, the attacker escalates privileges, pivots to internal network resources, or establishes persistence. No user interaction is required; the exploit triggers automatically during protocol negotiation. If a public proof-of-concept exists, script-based attacks against RRAS servers become feasible for less-skilled threat actors.