Windows RASMAN EUVD-2026-73101

Exploitation requires an authenticated local session with at least low-privilege access to the target Windows system - this is the primary limiting factor. The CVSS vector (AV:L/PR:L) confirms local access and an authenticated account are prerequisites; unauthenticated remote exploitation is not possible. No special configuration, non-default feature, or specific runtime state is described as required beyond the presence of the RASMAN service, which is active by default on all affected Windows versions. Exploitation is constrained to local attack surface: attackers must already be present on the machine (physically, via RDP, via lateral movement, or through a lower-privileged initial compromise). The lack of required user interaction (UI:N) means no secondary victim action is needed once the attacker has a local session.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a local privilege escalation requiring only a low-privileged authenticated session - no remote access, no social engineering, and no configuration preconditions are stated. The low attack complexity (AC:L) and absence of user interaction (UI:N) mean that once an attacker holds any local account, exploitation is straightforward. The scope is unchanged (S:U), but C:H/I:H/A:H indicates full system compromise within the affected process context, likely SYSTEM or network service. The breadth of affected versions - 19 distinct Windows builds from Server 2012 to Windows 11 26H1 - dramatically expands the real-world attack surface, especially in environments with shared workstations, multi-user servers, or post-initial-compromise lateral movement scenarios. No EPSS data or KEV listing is provided, and no POC is confirmed, which lowers immediate opportunistic exploitation risk; however, the simplicity of the trigger (AC:L) means reliable exploit development is plausible. This vulnerability is most impactful in environments where untrusted local users exist (RDS servers, VDI, shared endpoints) or as a privilege escalation step following initial foothold.

An attacker who has already obtained a low-privileged local account - through phishing, credential reuse, or initial exploitation of another vulnerability - connects to or interacts with the RASMAN service and sends crafted input that triggers the heap buffer overflow. With no user interaction required and low attack complexity, the attacker overwrites heap control structures to redirect execution, achieving code execution in the context of the RASMAN service process (typically running at elevated privilege), resulting in full local privilege escalation. No public proof-of-concept is confirmed at time of analysis, but the AC:L rating suggests reliable exploit development is feasible.