CVE-2025-26672 Overview
CVE-2025-26672 is an information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from a buffer over-read condition [CWE-126] that allows an unauthorized remote attacker to read memory contents beyond the intended buffer boundary. Successful exploitation requires user interaction, typically convincing a user to connect to a malicious server or open a crafted file. The vulnerability affects a broad range of Microsoft Windows client and server operating systems, from Windows 10 1507 through Windows Server 2025. Microsoft released a security patch as part of the April 2025 update cycle.
Critical Impact
An unauthenticated attacker can read sensitive memory contents from a vulnerable RRAS host over the network, potentially exposing credentials, cryptographic material, or other data useful for follow-on attacks.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-04-08 - CVE-2025-26672 published to NVD and Microsoft released the security update
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26672
Vulnerability Analysis
The Routing and Remote Access Service (RRAS) is a Windows component that provides routing, VPN, and dial-up remote access functions. RRAS parses network protocol messages exchanged between clients and servers during connection setup and tunnel negotiation. CVE-2025-26672 is a buffer over-read that occurs when RRAS processes a crafted message and reads past the end of an allocated buffer.
The result is out-of-bounds memory content being returned in a response or exposed through the protocol handling path. Successful attacks disclose confidentiality but do not affect data integrity or service availability. Because the affected code path is exposed by the RRAS service, any Windows host with RRAS installed and reachable over the network is potentially exposed.
Root Cause
The root cause is improper validation of a length or offset field during message parsing in RRAS [CWE-126]. When the service copies or emits data based on an attacker-controlled size, it reads adjacent memory that was never intended to be exposed. This adjacent memory may contain fragments of prior requests, connection state, or process heap contents.
Attack Vector
Exploitation is network-based and does not require authentication, but it does require user interaction. A typical scenario involves an attacker convincing a user to connect to an attacker-controlled RRAS endpoint or to open a crafted file that triggers an outbound RRAS interaction. The attacker then returns or triggers a response that leaks memory contents from the target process. No verified public proof-of-concept code is available at time of writing.
Detection Methods for CVE-2025-26672
Indicators of Compromise
- Unexpected outbound VPN or PPP connections from workstations to unknown RRAS endpoints.
- Anomalous RRAS event log entries referencing malformed packets or aborted negotiations.
- Unusual read patterns or memory access anomalies within the RasMan and RRAS-related service processes.
Detection Strategies
- Monitor Windows Event Log channels for RRAS and RemoteAccess service errors that correlate with malformed protocol messages.
- Inspect network telemetry for RRAS/PPTP/L2TP/SSTP traffic to endpoints outside sanctioned VPN infrastructure.
- Correlate user interaction events (link clicks, file opens) with subsequent RRAS-related network activity to identify social engineering attempts.
Monitoring Recommendations
- Enable telemetry on hosts running RRAS and forward logs to a centralized SIEM for correlation.
- Baseline normal RRAS traffic destinations and alert on connections to new or low-reputation IP addresses.
- Track patch compliance for the April 2025 Microsoft security updates across all Windows client and server systems.
How to Mitigate CVE-2025-26672
Immediate Actions Required
- Apply the Microsoft April 2025 security updates to all affected Windows client and server systems.
- Inventory hosts with the Routing and Remote Access Service installed and prioritize patching internet-facing systems.
- Educate users to avoid connecting to untrusted VPN endpoints or opening unsolicited connection profiles.
Patch Information
Microsoft has published fixes through the Microsoft Security Update Guide for CVE-2025-26672. Administrators should deploy the corresponding cumulative update for each affected Windows version through Windows Update, WSUS, or their preferred patch management platform.
Workarounds
- Disable the Routing and Remote Access Service on hosts that do not require it.
- Restrict outbound RRAS and VPN protocol traffic (PPTP, L2TP, SSTP) at the network perimeter to sanctioned endpoints only.
- Enforce application control policies that limit which VPN clients and connection profiles users can invoke.
# Disable RRAS on a Windows host where the service is not required
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
# Verify service state
sc.exe query RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
