CVE-2025-53153 Overview
CVE-2025-53153 is an information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from use of an uninitialized resource [CWE-908] within RRAS, allowing an authorized attacker to read memory contents over a network. Successful exploitation exposes potentially sensitive process memory to a remote attacker who has valid credentials and can induce user interaction. Microsoft addressed the issue in the August 2025 security update cycle. The vulnerability affects every supported Windows Server release from Windows Server 2008 through Windows Server 2025, including 23H2.
Critical Impact
An authenticated remote attacker can disclose uninitialized RRAS memory contents, potentially leaking sensitive data used for further compromise of the server or network.
Affected Products
- Microsoft Windows Server 2008 SP2 and 2008 R2 SP1
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-08-12 - CVE-2025-53153 published to NVD alongside Microsoft's security update
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53153
Vulnerability Analysis
The Routing and Remote Access Service (RRAS) provides routing, VPN, and dial-up connectivity for Windows Server. The service processes network requests that construct internal data structures before returning responses to the caller. In this flaw, RRAS allocates a resource but fails to initialize all of its fields before including that resource in a response.
As a result, residual memory contents from previous allocations are returned across the network. The disclosed bytes can contain fragments of prior request buffers, pointers, credentials, or configuration data. Attackers commonly chain this class of leak with memory corruption bugs to defeat address space layout randomization (ASLR) or extract session material.
Root Cause
The underlying weakness is classified under [CWE-908]: Use of Uninitialized Resource. RRAS code paths return or process a buffer, structure, or object whose memory was not zeroed or fully populated before use. The confidentiality impact is high, while integrity and availability remain unaffected.
Attack Vector
Exploitation requires network reachability to the RRAS service on the target Windows Server and valid low-privilege credentials. The attack also requires user interaction, meaning a legitimate user must perform an action that triggers the vulnerable code path. Once triggered, RRAS returns uninitialized memory to the attacker over the network. No code execution or persistence is achieved directly through this bug, but disclosed data can facilitate follow-on attacks.
No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported. Refer to the Microsoft Security Update Guide for authoritative technical details.
Detection Methods for CVE-2025-53153
Indicators of Compromise
- Unusual authenticated RRAS session activity from accounts or hosts that do not typically interact with routing services.
- Anomalous outbound response sizes or repeated RRAS requests originating from a single low-privilege user.
- RRAS service errors or handler exceptions logged around the time of suspicious remote sessions.
Detection Strategies
- Monitor Windows Event Logs on RRAS-enabled servers for atypical authentication events tied to the RemoteAccess and RasMan services.
- Correlate authenticated network flows to TCP/UDP ports used by RRAS (including PPTP 1723, L2TP 1701, and SSTP 443) with account behavior baselines.
- Alert on repeated small-response queries followed by extended data reads, which can indicate memory scraping.
Monitoring Recommendations
- Enable network telemetry capture on RRAS servers and forward to a centralized analytics platform for retention and hunting.
- Track patch state of Windows Server hosts running the RRAS role and flag any that remain on pre-August 2025 builds.
- Baseline expected RRAS clients and privileged administrator accounts; investigate deviations promptly.
How to Mitigate CVE-2025-53153
Immediate Actions Required
- Apply the August 2025 Microsoft security update for CVE-2025-53153 to every Windows Server running the RRAS role.
- Inventory all servers with the Routing and Remote Access role enabled and prioritize patching internet-exposed instances first.
- Rotate credentials and secrets that may have transited RRAS sessions on unpatched hosts if compromise is suspected.
Patch Information
Microsoft released fixes for all supported Windows Server versions listed in the advisory. Consult the Microsoft Security Update Guide for CVE-2025-53153 to identify the correct KB article for each Windows Server build, then deploy through Windows Update, WSUS, or your configuration management tooling.
Workarounds
- Disable the Routing and Remote Access service on servers where it is not required.
- Restrict RRAS network exposure using host-based firewalls and network segmentation, allowing only trusted management subnets.
- Enforce strong authentication and reduce the number of accounts authorized to initiate RRAS sessions.
# Disable and stop the RRAS service on hosts where it is not required (PowerShell, run as Administrator)
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess -Force
# Verify the RRAS role is not installed
Get-WindowsFeature -Name RemoteAccess, Routing, DirectAccess-VPN
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.