CVE-2025-29958 Overview
CVE-2025-29958 is an information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from the use of an uninitialized resource [CWE-908], which allows an unauthorized attacker to read memory contents over a network. Exploitation requires user interaction, meaning the attacker must convince a user to connect to a malicious RRAS server or open a crafted resource. Microsoft published the advisory on May 13, 2025, and the vulnerability affects a wide range of Windows client and server editions, from Windows 10 1507 through Windows 11 24H2 and Windows Server 2008 through Windows Server 2025.
Critical Impact
Successful exploitation exposes uninitialized memory contents from the RRAS process, potentially disclosing sensitive data such as credentials, session tokens, or routing configuration details across a network boundary.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server (2008, 2012, 2016, 2019, 2022, 2022 23H2, 2025)
Discovery Timeline
- 2025-05-13 - CVE-2025-29958 published to NVD
- 2025-05-13 - Microsoft releases security update addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29958
Vulnerability Analysis
RRAS provides routing services, VPN termination, and dial-up connectivity in Windows environments. The vulnerable code path within RRAS references a memory resource before the resource has been fully initialized. When the service processes an attacker-influenced request, the uninitialized memory contents are returned or reflected back over the network, leaking whatever data happened to reside in that memory region.
Because the attack vector is network-based and requires no privileges, any host that can reach an exposed RRAS endpoint may be targeted. However, the user interaction requirement means the attacker typically must coerce a client to initiate a connection to a malicious RRAS endpoint or interact with a crafted response.
Root Cause
The root cause is classified under [CWE-908], Use of Uninitialized Resource. A code path in RRAS allocates a buffer or structure and dispatches it to a network-facing routine without zeroing or fully populating the fields. The residual memory then becomes part of a response or protocol field observable to the peer.
Attack Vector
The attacker sets up a malicious RRAS server or intercepts a legitimate connection and induces a target user to initiate an RRAS session. During protocol negotiation, the vulnerable code returns uninitialized bytes to the attacker. Repeated interactions can be used to harvest additional memory contents, similar in principle to classic memory-disclosure primitives observed in other Windows networking components.
No public proof-of-concept or exploit code is currently available for CVE-2025-29958, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 1.094% (61.66 percentile) as of the most recent scoring.
Detection Methods for CVE-2025-29958
Indicators of Compromise
- Unexpected outbound RRAS or VPN connections from client hosts to unknown external endpoints on ports associated with PPTP (TCP 1723), L2TP (UDP 1701), or SSTP (TCP 443).
- RRAS service log entries showing repeated short-lived sessions or malformed protocol negotiations from a single remote peer.
- Anomalous RemoteAccess or RasMan event log entries on Windows Server hosts running the RRAS role.
Detection Strategies
- Inspect network telemetry for Windows endpoints initiating RRAS or VPN handshakes to non-corporate destinations, particularly following phishing or link-based lures.
- Alert on RRAS servers receiving repeated connection attempts from the same client that terminate before authentication completes, which is consistent with memory-scraping loops.
- Correlate Microsoft-Windows-RasServer and Microsoft-Windows-RemoteAccess event channels with EDR process telemetry to identify unauthorized invocation of RRAS client stacks.
Monitoring Recommendations
- Baseline which hosts legitimately use RRAS client or server functionality and alert on deviations.
- Forward RRAS-related Windows event channels to a centralized logging platform for long-term correlation and hunting.
- Monitor patch compliance state for all Windows client and Server SKUs listed in the Microsoft advisory to detect unpatched systems.
How to Mitigate CVE-2025-29958
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-29958 advisory to all affected Windows client and Server systems.
- Inventory hosts with the Routing and Remote Access role enabled and prioritize them in the patching cycle.
- Restrict inbound and outbound RRAS traffic at the network perimeter to known trusted endpoints only.
Patch Information
Microsoft addressed CVE-2025-29958 in the May 2025 Patch Tuesday cycle. Refer to the Microsoft Security Update CVE-2025-29958 advisory for the specific KB articles corresponding to each supported Windows version and channel.
Workarounds
- Disable the Routing and Remote Access service on hosts that do not require VPN or routing functionality using Set-Service -Name RemoteAccess -StartupType Disabled.
- Block RRAS-related ports at the host firewall on systems where the role must remain installed but is not actively serving clients.
- Enforce user awareness controls to reduce the likelihood of users initiating VPN connections to attacker-controlled endpoints in response to phishing lures.
# Configuration example: disable RRAS on hosts that do not require it
sc.exe stop RemoteAccess
sc.exe config RemoteAccess start= disabled
# Verify service state
Get-Service -Name RemoteAccess | Select-Object Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
