CVE-2024-26205: Windows 10 1507 RRAS RCE Vulnerability

CVE-2024-26205 Overview

CVE-2024-26205 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). Microsoft disclosed the flaw on April 9, 2024 as part of its monthly security update cycle. The vulnerability affects a broad range of Windows client and server versions, from Windows 10 1507 through Windows Server 2022 23H2.

The root cause is a heap-based buffer overflow [CWE-122] in the RRAS component. An unauthenticated attacker on the network can exploit the flaw, but successful exploitation requires user interaction. Microsoft assigned a CVSS 3.1 score of 8.8 with confidentiality, integrity, and availability all rated High.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary code in the context of the RRAS service on a vulnerable Windows system, potentially leading to full host compromise.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2)
Microsoft Windows Server (2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2)

Discovery Timeline

2024-04-09 - CVE-2024-26205 published to NVD
2024-04-09 - Microsoft releases security update addressing the vulnerability
2025-01-08 - Last updated in NVD database

Technical Details for CVE-2024-26205

Vulnerability Analysis

The vulnerability resides in the Windows Routing and Remote Access Service, a server role used for routing, dial-up access, and virtual private network (VPN) services. RRAS processes network protocol traffic across multiple interfaces, including PPTP, L2TP, SSTP, and IKEv2.

The weakness is classified as a heap-based buffer overflow [CWE-122]. RRAS allocates a buffer on the heap and writes attacker-controlled data past its bounds when handling crafted protocol input. The corrupted heap structures can be steered to overwrite function pointers or virtual table entries, redirecting execution to attacker-supplied code.

The attack is network reachable, requires no privileges, and runs at low complexity. However, the CVSS vector indicates that user interaction is required, suggesting a victim must initiate or respond to a connection involving the malicious server or client.

Root Cause

The flaw stems from missing or incorrect length validation when RRAS parses inbound protocol structures. Memory is allocated based on one size value while data is copied based on another, producing an out-of-bounds heap write. Microsoft has not published the specific protocol handler at fault.

Attack Vector

An attacker reaches the vulnerable code by inducing a target system running RRAS to process a malicious network message. The user interaction requirement indicates a likely scenario where a victim connects to an attacker-controlled VPN or remote access endpoint. Once the malformed payload is parsed, the heap overflow triggers code execution within the privileged RRAS service process.

No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 1.805% (75.6 percentile), indicating elevated relative exploit prediction compared to typical CVEs.

Detection Methods for CVE-2024-26205

Indicators of Compromise

Unexpected svchost.exe instances hosting RRAS spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
Crashes or restarts of the RemoteAccess service logged in the System event log
Outbound connections from RRAS service processes to untrusted hosts following inbound VPN or dial-up sessions
Unusual heap allocation patterns or access violations within mprdim.dll, rasmans.dll, or related RRAS modules

Detection Strategies

Hunt for process lineage anomalies where the RRAS-hosting svchost.exe spawns interactive shells or scripting hosts
Alert on RRAS service crashes followed by service restarts within a short interval, a signature of exploit attempts
Inspect VPN authentication and connection logs for repeated failures or malformed protocol negotiations from a single source
Use endpoint behavioral detection to flag memory protection violations inside RRAS service processes

Monitoring Recommendations

Forward Windows Event Logs (System, Security, RemoteAccess operational channels) to a centralized SIEM for correlation
Capture and review network telemetry on TCP/1723 (PPTP), UDP/500 and UDP/4500 (IKE/IPsec), and TCP/443 (SSTP)
Establish baselines for RRAS process behavior and alert on deviations such as new module loads or outbound C2-like traffic
Track patch status for KB updates referenced in the Microsoft Security Update Guide across all Windows hosts with RRAS enabled

How to Mitigate CVE-2024-26205

Immediate Actions Required

Apply the April 2024 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows client and server versions
Inventory systems where the Routing and Remote Access service is installed or running, prioritizing internet-exposed VPN gateways
Restrict inbound access to RRAS endpoints to known administrative networks until patching is complete
Verify that legacy Server 2008 and 2012 systems receive applicable Extended Security Updates

Patch Information

Microsoft released cumulative security updates on April 9, 2024 that address CVE-2024-26205 across all supported Windows versions. Refer to the Microsoft Security Update for CVE-2024-26205 advisory for the specific KB article matching each operating system build. Apply the update through Windows Update, WSUS, or your standard patch management workflow.

Workarounds

Disable the Routing and Remote Access service on systems that do not require it using Set-Service -Name RemoteAccess -StartupType Disabled followed by Stop-Service RemoteAccess
Block inbound traffic to RRAS protocol ports (TCP/1723, TCP/443 for SSTP, UDP/500, UDP/4500) at the perimeter firewall where remote access is not needed
Require strong authentication and limit VPN client connections to trusted users and devices through network access control policies

bash

# Configuration example: disable RRAS where not required
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess

# Verify patch status (replace KB with the article for your OS build)
wmic qfe list brief | findstr KB5036