CVE-2025-26664 Overview
CVE-2025-26664 is an information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS). A buffer over-read condition [CWE-126] allows an unauthorized attacker to read memory beyond the intended buffer boundary. The flaw can be triggered over a network when a user is convinced to interact with a malicious resource controlled by the attacker.
Microsoft published the advisory on April 8, 2025. Successful exploitation exposes potentially sensitive memory contents from the RRAS process to a remote actor. No public proof-of-concept has been observed, and CISA has not added the issue to its Known Exploited Vulnerabilities catalog.
Critical Impact
Remote attackers can disclose sensitive process memory from Windows Server systems running RRAS, potentially exposing credentials, session data, or configuration secrets.
Affected Products
- Microsoft Windows Server 2008 SP2, Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26664 published to NVD
- 2025-04-08 - Microsoft releases security advisory and patch
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26664
Vulnerability Analysis
The vulnerability resides in the Windows Routing and Remote Access Service (RRAS), a Windows Server component that provides routing, VPN, and dial-up remote access. RRAS parses several tunneling and routing protocols, exposing complex packet-processing code paths to network input.
The defect is classified as a buffer over-read [CWE-126]. During processing of an attacker-supplied message, RRAS reads memory past the end of an allocated buffer. The out-of-bounds data can then be returned to the requesting party, disclosing residual heap or stack contents.
Exploitation requires user interaction, as reflected in the CVSS vector UI:R. An attacker must convince a user or administrator to connect to or interact with a malicious server or resource that responds with a crafted RRAS message. The confidentiality impact is high, while integrity and availability are unaffected.
Root Cause
The root cause is missing or incorrect length validation when RRAS reads a variable-length field from an untrusted message. A boundary check on the declared field length against the actual received buffer size is either missing or performed after the read. The result is an over-read [CWE-126] that leaks adjacent process memory.
Attack Vector
The attack vector is network based with low complexity and no authentication required. A typical scenario involves an attacker hosting a malicious RRAS or VPN endpoint. When a user initiates a connection or clicks a lure that triggers an RRAS client-side interaction, the server returns a crafted response that causes the over-read. Disclosed memory can be exfiltrated within subsequent protocol responses.
No verified exploit code is publicly available. See the Microsoft CVE-2025-26664 Advisory for vendor-supplied technical guidance.
Detection Methods for CVE-2025-26664
Indicators of Compromise
- Unexpected outbound RRAS or VPN connections from Windows Server hosts to unknown external endpoints.
- Anomalous crashes, exceptions, or memory faults in the RemoteAccess or svchost.exe process hosting RRAS.
- Repeated malformed RRAS protocol responses observed at network egress or on VPN gateways.
Detection Strategies
- Monitor Windows event logs for RRAS service faults, restarts, and Watson error reports referencing the RemoteAccess service.
- Inspect network traffic for malformed PPTP, L2TP, or SSTP responses returned to internal clients from untrusted hosts.
- Correlate user-initiated VPN connection attempts with subsequent unusual memory or CPU behavior on the initiating host.
Monitoring Recommendations
- Enable verbose RRAS logging and forward events to a centralized logging or SIEM platform for baseline analysis.
- Track outbound connections from servers where the Routing and Remote Access role is installed but not actively used.
- Alert on newly installed or newly enabled RRAS roles across the Windows Server fleet.
How to Mitigate CVE-2025-26664
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-26664 Advisory to all affected Windows Server versions.
- Inventory servers with the Routing and Remote Access role installed and prioritize patching internet-exposed systems.
- Restrict outbound VPN and RRAS client connections from servers to only known, trusted endpoints.
Patch Information
Microsoft addressed CVE-2025-26664 in the April 2025 Patch Tuesday release. Cumulative updates are available for Windows Server 2008 SP2, 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Refer to the vendor advisory for the specific KB article and update package for each supported operating system.
Workarounds
- Disable the Routing and Remote Access Service on servers that do not require RRAS or VPN functionality.
- Block RRAS-related protocols such as PPTP (TCP/1723), L2TP (UDP/1701), and SSTP (TCP/443 to untrusted hosts) at network egress where feasible.
- Enforce user awareness controls to prevent interaction with untrusted VPN configuration files or unknown remote access prompts.
# Disable the Routing and Remote Access service on a Windows Server host
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess -Force
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
