EUVD-2026-56374
GHSA-5fmj-6x8v-3p2w
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack via RASMAN requiring only a low-privilege user account; no interaction needed; full triad compromise reflects SYSTEM-level escalation from a standard service process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in the Windows Remote Access Connection Manager (RASMAN) service enables a low-privileged local attacker to achieve SYSTEM-level access through a heap-based buffer overflow. Affecting Windows 10 (from version 1809), Windows 11 (through version 26H1), Windows Server 2019 through Server 2025, this vulnerability requires only a valid local user account and no user interaction. Microsoft has released patches via MSRC; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
The Windows Remote Access Connection Manager (service binary: rasman.exe) is a core Windows OS service managing VPN, dial-up, and other remote access connections across client and server editions. The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), a memory corruption class where data written to a heap-allocated buffer exceeds its bounds, overwriting adjacent heap metadata, function pointers, or control structures. In a high-privilege service process such as RASMAN, this class of flaw is classically leveraged for local privilege escalation by overwriting heap structures to redirect execution. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates that any authenticated local user can trigger the overflow without elevated rights, additional configuration, or assistance from other users, implying the service processes attacker-supplied input without sufficient bounds validation.
RemediationAI
Apply the vendor-released security updates via Windows Update or WSUS immediately. Specific patched build thresholds by platform are: Windows 10 1809 and Windows Server 2019 → 10.0.17763.9115 or later; Windows 10 21H2 → 10.0.19044.7663; Windows 10 22H2 → 10.0.19045.7663; Windows 11 23H2 → 10.0.22631.7517; Windows 11 24H2 → 10.0.26100.9168; Windows Server 2025 and Server Core → 10.0.26100.33296; Windows 11 25H2 → 10.0.26200.9168; Windows 11 26H1 → 10.0.28000.2704; Windows Server 2022 → 10.0.20348.5499. The authoritative advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62783. If patching cannot be applied immediately, restrict local interactive logon rights to trusted administrators only via Group Policy under Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment → 'Allow log on locally' - this raises the bar from any local user to administrator-class accounts, though it may impact legitimate users who require local access. On systems where VPN and dial-up functionality are genuinely unused, disabling the RASMAN service (via services.msc or 'Set-Service -Name RasMan -StartupType Disabled') eliminates the attack surface entirely, but will break Remote Access and VPN client functionality - evaluate operational impact before applying this control.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today