CVE-2025-29961 Overview
CVE-2025-29961 is an out-of-bounds read vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw allows an unauthenticated remote attacker to read memory outside of allocated buffer boundaries, resulting in information disclosure over a network. Exploitation requires user interaction, typically by convincing a target to connect to an attacker-controlled server or open a malicious file. Microsoft published this vulnerability on May 13, 2025, and it affects a broad range of Windows client and server operating systems that expose RRAS functionality.
Critical Impact
An unauthorized attacker can trigger an out-of-bounds read in RRAS to disclose potentially sensitive memory contents over the network, aiding follow-on attacks against affected Windows systems.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-05-13 - CVE-2025-29961 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-29961
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds read [CWE-125] within the Windows Routing and Remote Access Service. RRAS is a Windows component that provides routing, VPN, and dial-up remote access capabilities. When RRAS processes specially crafted network traffic or protocol data, it reads memory beyond the intended buffer, exposing adjacent memory content back to the caller. The disclosed data can include process memory, protocol state, or other information that assists an attacker in bypassing address space layout randomization (ASLR) or preparing subsequent exploitation. The scope is limited to confidentiality — the vulnerability does not allow modification of data or denial of service on its own.
Root Cause
The underlying defect is improper validation of length or index values while parsing input handled by RRAS. The service accesses memory locations outside the bounds of a validly allocated buffer, returning data that should not be exposed to remote callers. This class of flaw typically stems from missing bounds checks on attacker-controlled size fields or offsets during protocol message deserialization.
Attack Vector
Exploitation occurs over the network and does not require authentication, but the attack requires user interaction. A likely attack scenario involves convincing a user on an RRAS-connected system to initiate a connection to a malicious server that returns crafted responses. Successful exploitation returns leaked memory contents to the attacker, supporting reconnaissance and enabling further chained attacks against the affected host.
No verified proof-of-concept code is publicly available for this CVE. Refer to the Microsoft Security Update Guide entry for CVE-2025-29961 for authoritative technical detail.
Detection Methods for CVE-2025-29961
Indicators of Compromise
- Unexpected outbound connections from systems running RRAS to untrusted remote endpoints on VPN or routing protocol ports.
- Anomalous RRAS process (svchost.exe hosting RemoteAccess) memory access patterns or unusual crashes shortly after remote connections.
- Repeated malformed protocol messages received by RRAS logged in Windows Event Log.
Detection Strategies
- Monitor Windows event logs for RRAS service errors, restarts, or protocol parsing anomalies that may indicate exploitation attempts.
- Inspect network telemetry for outbound VPN or PPP negotiation traffic to unknown or newly registered domains.
- Correlate user-initiated connection events with RRAS process behavior to identify social engineering–driven exploitation.
Monitoring Recommendations
- Enable verbose logging on RRAS-enabled hosts and forward events to a centralized log analytics platform for correlation.
- Track process memory read patterns and unexpected data egress from systems where RRAS is enabled.
- Baseline normal RRAS client and server behavior to flag deviations that may signal probing or exploitation.
How to Mitigate CVE-2025-29961
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-29961 to all affected Windows client and server versions.
- Inventory systems that have the RRAS role enabled and prioritize patching of internet-exposed or high-value hosts.
- Educate users about the risks of connecting to untrusted VPN or dial-up endpoints, given the user interaction requirement.
Patch Information
Microsoft released fixes as part of the May 2025 Patch Tuesday cycle. Consult the Microsoft CVE-2025-29961 Update for the specific KB articles and cumulative updates that apply to each affected Windows build.
Workarounds
- Disable the Routing and Remote Access Service on systems that do not require VPN, routing, or dial-up functionality.
- Restrict inbound and outbound RRAS-related traffic at the network perimeter to trusted endpoints only.
- Enforce use of managed VPN concentrators and block user-initiated connections to unapproved remote access servers.
# Disable RRAS on hosts that do not require the service
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess
# Verify the service state
sc.exe query RemoteAccess
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
