CVE-2025-29836: Windows 10 Information Disclosure Flaw

CVE-2025-29836 Overview

CVE-2025-29836 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Routing and Remote Access Service (RRAS). An unauthorized attacker can exploit this flaw over the network to disclose sensitive memory contents from an affected system. Exploitation requires user interaction, which typically involves convincing a user to connect to a malicious server or open a crafted resource.

The vulnerability affects a broad range of Microsoft Windows client and server operating systems, including Windows 10, Windows 11, and Windows Server versions from 2008 through 2025. Microsoft published the advisory on May 13, 2025.

Critical Impact
Successful exploitation results in the disclosure of confidential memory contents from RRAS-enabled Windows hosts, potentially exposing credentials, session tokens, or configuration data useful for follow-on attacks.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-05-13 - CVE-2025-29836 published to NVD
2025-05-13 - Microsoft releases security update addressing the vulnerability
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29836

Vulnerability Analysis

The Routing and Remote Access Service (RRAS) provides routing, VPN, and dial-up remote access services on Windows. The service parses network protocol data during connection negotiation and packet processing. CVE-2025-29836 is an out-of-bounds read [CWE-125] that occurs when RRAS processes crafted network input without correctly validating a length or offset field.

When the flawed code path executes, the service reads memory beyond the intended buffer boundary. That memory can contain adjacent process data, including uninitialized heap contents, pointers, or session state. The service returns or reflects portions of this data in a way that reaches the attacker, resulting in information disclosure.

The issue does not permit modification of data or interruption of service, so integrity and availability remain intact. The disclosed information can, however, aid attackers in bypassing address-space layout randomization or reconstructing credentials for subsequent intrusions.

Root Cause

The root cause is missing or insufficient bounds checking on a length field within an RRAS protocol handler. The affected function reads more bytes than the buffer contains, returning adjacent memory to the caller. This is a classic [CWE-125] Out-of-Bounds Read defect.

Attack Vector

The attack vector is network-based and requires user interaction, such as an administrator or user connecting to an attacker-controlled RRAS endpoint or accepting a crafted remote access session. Once the victim initiates the connection, the malicious server sends a specially formed packet that triggers the over-read and returns memory contents to the attacker. No authentication is required to reach the vulnerable code path.

No public proof-of-concept exploit is available for this issue, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 1.064% with a percentile of 60.59, indicating a moderate likelihood of exploitation attempts relative to other CVEs.

Detection Methods for CVE-2025-29836

Indicators of Compromise

Unexpected outbound connections from Windows hosts to unknown RRAS or VPN endpoints on TCP/UDP ports associated with PPTP (1723), L2TP (1701), or SSTP (443).
Anomalous RRAS service (RemoteAccess, svchost.exe hosting rasmans.dll) memory usage or crashes in the Windows Event Log.
Unusual client-initiated RRAS negotiation sequences with malformed length fields captured in network telemetry.

Detection Strategies

Monitor for outbound RRAS/VPN connections to non-corporate destinations, particularly following phishing or link-click events.
Inspect network traffic for malformed RRAS protocol frames using intrusion detection signatures that flag oversized or truncated length fields.
Correlate endpoint process telemetry showing svchost.exe loading RRAS DLLs with concurrent outbound network activity to untrusted hosts.

Monitoring Recommendations

Enable and centralize Windows Event Log collection for the RemoteAccess service and Windows Filtering Platform events.
Track patch compliance for the May 2025 Windows security updates across all client and server endpoints.
Alert on new or unauthorized RRAS client configurations pushed via Group Policy or user profile changes.

How to Mitigate CVE-2025-29836

Immediate Actions Required

Apply the May 2025 Microsoft security update referenced in the Microsoft Security Update CVE-2025-29836 advisory to all affected Windows client and server systems.
Prioritize patching on internet-facing systems and hosts where users may initiate outbound VPN or remote access connections.
Educate users to avoid connecting to unsolicited or untrusted VPN and remote access endpoints.

Patch Information

Microsoft addressed CVE-2025-29836 as part of its May 13, 2025 Patch Tuesday release. Administrators should deploy the cumulative update through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog. Refer to the Microsoft Security Update CVE-2025-29836 guidance for the specific KB article corresponding to each Windows version.

Workarounds

Disable the Routing and Remote Access Service on systems that do not require VPN or routing functionality using Set-Service -Name RemoteAccess -StartupType Disabled.
Restrict outbound access to remote RRAS endpoints via host firewall or network egress policy where remote access clients are not required.
Segment RRAS servers on isolated networks and require multi-factor authentication for administrators who manage them.

bash

# Disable the Routing and Remote Access service on hosts that do not need it
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess

# Verify current status
sc.exe query RemoteAccess