CVE-2025-53797 Overview
CVE-2025-53797 is a buffer over-read vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw lets an unauthorized network-based attacker read memory beyond an allocated buffer and disclose sensitive information over the network. Exploitation requires user interaction, which typically means convincing a user to connect to or interact with an attacker-controlled endpoint. The weakness is tracked as [CWE-126] Buffer Over-read and affects every currently supported Windows Server release, from Windows Server 2008 through Windows Server 2025. Microsoft published the advisory on September 9, 2025.
Critical Impact
A remote, unauthenticated attacker can read memory contents from RRAS processes over the network, exposing sensitive data that may aid follow-on attacks against domain infrastructure.
Affected Products
- Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012 and Windows Server 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-53797 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53797
Vulnerability Analysis
The vulnerability resides in the Routing and Remote Access Service, a Windows role that provides VPN, dial-up, and multi-protocol routing capabilities. RRAS parses network protocol messages from remote clients, and the affected code path reads past the end of an allocated buffer while processing attacker-supplied input. The out-of-bounds read returns adjacent process memory to the caller, producing an information disclosure primitive over the network.
Because the disclosed bytes originate from the RRAS service address space, they may include protocol state, authentication material, session identifiers, or heap metadata useful for bypassing address space layout randomization (ASLR) in a subsequent exploit chain.
Root Cause
The root cause is a missing or incorrect length check when RRAS deserializes fields from an inbound protocol message. The service trusts a length or offset value derived from untrusted input and copies or reads bytes beyond the actual buffer bounds, which is the defining pattern of [CWE-126].
Attack Vector
The attack is network-reachable and requires no privileges, but it does require user interaction. A typical scenario involves an attacker luring a user or administrator into initiating an RRAS or VPN client transaction with a malicious server that returns crafted protocol responses. The response triggers the over-read on the client or server-side RRAS component, and the leaked bytes are returned to the attacker in subsequent protocol traffic.
No public proof-of-concept or in-the-wild exploitation is documented, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is approximately 1.08%.
See the Microsoft CVE-2025-53797 Advisory for vendor technical details.
Detection Methods for CVE-2025-53797
Indicators of Compromise
- Unexpected inbound or outbound connections to TCP/UDP ports associated with RRAS, including PPTP (TCP/1723), L2TP (UDP/1701), SSTP (TCP/443), and GRE traffic from unfamiliar peers.
- Repeated or malformed RRAS protocol messages from a single external source, particularly with anomalous length or offset fields.
- RRAS service instability, crashes, or repeated RemoteAccess service restarts logged in the System event log.
Detection Strategies
- Inspect RRAS protocol traffic at the perimeter for oversized or truncated length fields that could trigger the over-read.
- Correlate authentication and VPN session logs to identify short-lived, unauthenticated sessions that terminate immediately after protocol negotiation.
- Baseline normal RRAS peers and alert on new external sources initiating routing or remote access handshakes.
Monitoring Recommendations
- Forward Windows event channels Microsoft-Windows-RemoteAccess, System, and Security to a central SIEM for retention and correlation.
- Monitor for the RemoteAccess, RasMan, and SstpSvc services entering an unhealthy state or restarting outside maintenance windows.
- Track egress volumes from RRAS hosts to identify sustained data exfiltration patterns consistent with memory disclosure abuse.
How to Mitigate CVE-2025-53797
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2025-53797 Advisory to all affected Windows Server builds.
- Inventory every server running the RemoteAccess role and prioritize internet-facing systems and VPN concentrators for patching first.
- Restrict inbound access to RRAS listeners to known VPN client networks using host and perimeter firewalls until patches are deployed.
Patch Information
Microsoft released fixes for CVE-2025-53797 as part of its September 9, 2025 security update cycle. Updates are available for Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Consult the vendor advisory for exact KB article identifiers per operating system build.
Workarounds
- Disable the Routing and Remote Access role on servers that do not require VPN or multi-protocol routing functionality.
- Terminate VPN and RRAS traffic on a hardened gateway that filters malformed protocol messages before they reach Windows RRAS servers.
- Enforce strict egress filtering from RRAS servers so that leaked memory cannot be exfiltrated to arbitrary external endpoints.
# Stop and disable the Routing and Remote Access service on hosts that do not require it
sc.exe stop RemoteAccess
sc.exe config RemoteAccess start= disabled
# Block inbound RRAS protocol ports at the host firewall (adjust to your environment)
netsh advfirewall firewall add rule name="Block PPTP" dir=in action=block protocol=TCP localport=1723
netsh advfirewall firewall add rule name="Block L2TP" dir=in action=block protocol=UDP localport=1701
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
