CVE-2024-30095 Overview
CVE-2024-30095 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw affects a broad range of Microsoft Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2008 through 2022 23H2. Microsoft categorizes the weakness under [CWE-122] Heap-based Buffer Overflow and [CWE-787] Out-of-bounds Write. Exploitation requires local access and user interaction, but successful attacks can compromise confidentiality, integrity, and availability of the host.
Critical Impact
An attacker who convinces a local user to interact with a crafted input can trigger a heap-based buffer overflow in RRAS and execute arbitrary code on the affected system.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-06-11 - CVE-2024-30095 published to NVD
- 2024-06-11 - Microsoft published the security update guide for CVE-2024-30095
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2024-30095
Vulnerability Analysis
The vulnerability resides in the Routing and Remote Access Service (RRAS), a Windows role that provides routing, VPN, and dial-up services. Microsoft classifies the issue as a heap-based buffer overflow ([CWE-122]) combined with an out-of-bounds write ([CWE-787]). Both weaknesses point to improper size validation when RRAS processes attacker-influenced data on the local system.
Successful exploitation yields code execution in the RRAS process context. Because RRAS runs with elevated privileges, code execution can lead to full compromise of the host. The CVSS vector indicates the attack is local and requires user interaction, which suggests the vulnerable code path is reached through user-driven activity rather than unauthenticated network access.
Root Cause
The root cause is insufficient bounds checking in RRAS when parsing structured input. When the service copies attacker-controlled data into a fixed-size heap buffer, it writes past the allocated region. The resulting heap corruption can overwrite adjacent structures, function pointers, or metadata used by the allocator.
Attack Vector
Exploitation requires local access and user interaction. An attacker crafts input that reaches RRAS through a supported interface, then relies on a user action to trigger processing. If the overflow is shaped to overwrite control data, the attacker gains arbitrary code execution on the target. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor detail.
Detection Methods for CVE-2024-30095
Indicators of Compromise
- Unexpected crashes or restarts of the RemoteAccess service or svchost.exe instances hosting RRAS
- Windows Error Reporting entries referencing RRAS binaries such as rrasmgmt.dll or mprdim.dll
- New child processes spawned by the RRAS service process, especially command interpreters or scripting hosts
Detection Strategies
- Monitor for anomalous process creation lineage where the RRAS service parent process launches non-standard executables
- Correlate service crash events (Event ID 7031, 7034) for RemoteAccess with subsequent suspicious activity on the host
- Track exploitation-adjacent behaviors such as heap spray patterns, injected threads, and token manipulation originating from RRAS
Monitoring Recommendations
- Enable command-line auditing and Sysmon process creation logging on all servers with the RRAS role installed
- Forward Windows service, security, and Sysmon logs to a centralized analytics platform for cross-host correlation
- Alert on RRAS binary integrity changes and on any modification to routing or remote access configuration outside change windows
How to Mitigate CVE-2024-30095
Immediate Actions Required
- Apply the Microsoft June 2024 security update that addresses CVE-2024-30095 across all affected Windows and Windows Server builds
- Inventory hosts with the Routing and Remote Access role enabled and prioritize patching those systems first
- Restrict local logon rights on RRAS servers to a minimal set of administrative accounts
Patch Information
Microsoft released fixes documented in the Microsoft Security Update Guide for CVE-2024-30095. Patches are available for all listed Windows 10, Windows 11, and Windows Server versions. Administrators should validate the update through standard change management and confirm the RemoteAccess service returns to a healthy state after installation.
Workarounds
- Disable the Routing and Remote Access Service on hosts where the role is not required, using Set-Service -Name RemoteAccess -StartupType Disabled
- Remove the Remote Access server role entirely on systems that do not need VPN or routing functionality
- Enforce least privilege and application control policies to limit which local users can interact with RRAS management interfaces
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
