CVE-2024-26179: Windows RRAS Remote Code Execution Flaw

CVE-2024-26179 Overview

CVE-2024-26179 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw affects a broad range of Microsoft Windows desktop and server versions, including Windows 10, Windows 11, and Windows Server 2008 through 2022. Microsoft classifies the issue under [CWE-122] (Heap-based Buffer Overflow), indicating that an attacker can corrupt heap memory to gain arbitrary code execution. Exploitation requires user interaction over the network, typically by convincing a target to connect to an attacker-controlled server or process malicious traffic through RRAS.

Critical Impact

Successful exploitation allows attackers to execute arbitrary code on systems where the Routing and Remote Access Service is enabled, compromising confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-04-09 - CVE-2024-26179 published to NVD and Microsoft releases security update
• 2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-26179

Vulnerability Analysis

The vulnerability resides in the Windows Routing and Remote Access Service (RRAS), a Microsoft service that provides routing, dial-up access, VPN connectivity, and NAT functionality. RRAS handles network protocol parsing across multiple components, exposing a large attack surface for memory corruption flaws. An attacker who exploits this issue can run code in the context of the RRAS process, potentially leading to full system compromise on hosts where RRAS is configured.

Exploitation requires user interaction, meaning a victim must perform an action such as connecting to a malicious server or initiating a routing session that processes attacker-controlled data. The network attack vector and low complexity make this issue attractive for opportunistic exploitation against exposed RRAS deployments.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in RRAS protocol handling code. When RRAS processes specially crafted network input, it writes beyond an allocated heap buffer. This out-of-bounds write corrupts adjacent heap structures and function pointers, which an attacker can leverage to redirect execution flow into attacker-controlled code.

Attack Vector

An attacker delivers a malicious payload to an RRAS endpoint over the network. The attack requires user interaction, such as a user initiating a connection that causes RRAS to parse the crafted data. Once the heap is corrupted, the attacker achieves arbitrary code execution in the service context. Systems without RRAS enabled are not affected, which limits the exposed population but does not eliminate risk for routing, VPN, and edge servers that commonly run the service.

Detection Methods for CVE-2024-26179

Indicators of Compromise

• Unexpected crashes, restarts, or memory faults in the RemoteAccess or RasMan services
• Anomalous child processes spawned by RRAS service binaries
• Unusual outbound connections originating from RRAS host processes
• New or modified routing configurations, RRAS interfaces, or VPN tunnels not initiated by administrators

Detection Strategies

• Monitor Windows Event Logs for Service Control Manager entries showing RRAS service termination or restart loops
• Inspect inbound traffic to RRAS ports (PPTP/1723, L2TP/1701, SSTP/443, and IKE/500, 4500) for malformed or oversized protocol fields
• Hunt for process lineage anomalies where RRAS-related services launch cmd.exe, powershell.exe, or rundll32.exe

Monitoring Recommendations

• Enable detailed RRAS logging and forward events to a centralized SIEM for correlation
• Track patch state across all servers running the Remote Access role to identify unpatched assets
• Alert on changes to RRAS configuration registry keys under HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess

How to Mitigate CVE-2024-26179

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Vulnerability Update CVE-2024-26179 advisory to all affected systems
• Inventory all hosts with the Remote Access role enabled and prioritize patching internet-exposed RRAS servers first
• Restrict inbound network access to RRAS endpoints using firewall rules and network segmentation

Patch Information

Microsoft released patches on April 9, 2024 covering all affected Windows desktop and server versions listed in the advisory. Refer to the Microsoft Vulnerability Update CVE-2024-26179 page for the specific KB articles and download links for each supported build.

Workarounds

• Disable the Routing and Remote Access Service on systems where it is not required using Set-Service -Name RemoteAccess -StartupType Disabled
• Block external access to RRAS-related ports (TCP 1723, UDP 1701, TCP 443 for SSTP, UDP 500/4500 for IKE) at the perimeter firewall
• Limit RRAS connections to authenticated, trusted source networks via IPsec or VPN access policies until patching is complete

# Configuration example: disable RRAS where not required
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled

# Verify status
Get-Service -Name RemoteAccess