CVE-2025-29960 Overview
CVE-2025-29960 is an out-of-bounds read vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw allows an unauthorized remote attacker to disclose information over a network when a user is tricked into interacting with a malicious client or server. The weakness is classified as [CWE-125] Out-of-bounds Read and affects a broad range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2008 through 2025. Microsoft published the advisory as part of its May 2025 Patch Tuesday cycle.
Critical Impact
A successful attacker can read memory contents beyond the intended buffer boundary in the RRAS component, potentially exposing sensitive information across the network.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-05-13 - CVE-2025-29960 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29960
Vulnerability Analysis
The Windows Routing and Remote Access Service (RRAS) provides routing, VPN, and dial-up connectivity functions on Windows client and server systems. CVE-2025-29960 is an out-of-bounds read that allows an attacker to retrieve memory contents outside the boundaries of an allocated buffer. Because the attack vector is network-based and requires no privileges, the attacker only needs to induce a user to connect to or interact with an attacker-controlled RRAS endpoint. Confidentiality is directly impacted, while integrity and availability are not affected. The current EPSS probability is 1.259% with a percentile of 66.158, indicating moderate likelihood of exploitation activity relative to other CVEs.
Root Cause
The root cause is improper validation of length or index values when RRAS parses network-supplied data structures. When a crafted response or request is processed, the code reads past the end of the intended buffer. This behavior is characteristic of [CWE-125] and typically results from missing bounds checks before dereferencing a pointer or copying memory during protocol parsing.
Attack Vector
Exploitation requires user interaction. An attacker hosts a malicious RRAS server or crafts a malicious response, then convinces a target user or system to initiate a connection. When RRAS processes the crafted payload, it reads memory outside the intended buffer and returns portions of that memory to the attacker. See the Microsoft CVE-2025-29960 Advisory for authoritative technical details.
No verified public proof-of-concept code is available for CVE-2025-29960.
Refer to the Microsoft Security Response Center advisory for technical guidance.
Detection Methods for CVE-2025-29960
Indicators of Compromise
- Unexpected outbound RRAS or VPN connections from workstations to untrusted external hosts.
- Anomalous PPP, L2TP, or SSTP session negotiation traffic originating from client endpoints.
- Endpoint logs showing rasman.exe, svchost.exe -k NetworkService, or RRAS-related services crashing or reading unusual memory regions.
Detection Strategies
- Monitor Windows Event Logs for RemoteAccess service errors and abnormal termination events on hosts where RRAS is enabled.
- Inspect network telemetry for outbound VPN handshakes to newly registered or low-reputation domains and IPs.
- Correlate user-initiated connections to remote access endpoints with subsequent memory anomalies or crashes in RRAS processes.
Monitoring Recommendations
- Baseline normal RRAS usage per host and alert on deviations, particularly on client systems that should not initiate outbound VPN connections.
- Continuously monitor patch state across Windows 10, Windows 11, and Windows Server systems to identify hosts still exposed to CVE-2025-29960.
- Track authentication and session logs on VPN gateways for reconnaissance attempts targeting RRAS endpoints.
How to Mitigate CVE-2025-29960
Immediate Actions Required
- Apply the May 2025 Microsoft security updates addressing CVE-2025-29960 to all affected Windows client and server systems.
- Inventory hosts with the Routing and Remote Access role enabled and prioritize them for patching.
- Restrict user permissions to initiate outbound VPN or dial-up connections to only sanctioned endpoints.
Patch Information
Microsoft released fixes for CVE-2025-29960 through the Microsoft CVE-2025-29960 Advisory. Administrators should deploy the appropriate cumulative update for each Windows version listed in the advisory, covering Windows 10, Windows 11, and Windows Server 2008 through 2025.
Workarounds
- Disable the Routing and Remote Access Service on hosts that do not require RRAS functionality.
- Block outbound connections to untrusted remote access endpoints at the network perimeter and enforce allowlists for VPN destinations.
- Educate users to avoid connecting to unsolicited or untrusted VPN, dial-up, or remote access configurations.
# Disable and stop the Routing and Remote Access service on Windows hosts
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
# Verify service status
sc.exe query RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
