CVE-2025-54095 Overview
CVE-2025-54095 is an out-of-bounds read vulnerability [CWE-125] in the Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can exploit this flaw over the network to read memory contents beyond an allocated buffer, disclosing potentially sensitive information from the RRAS process address space. Exploitation requires user interaction, typically involving an administrator or user connecting to an attacker-controlled RRAS endpoint. The vulnerability affects a broad range of Microsoft server products, from Windows Server 2008 through Windows Server 2025. Microsoft published an advisory and security update on September 9, 2025.
Critical Impact
Successful exploitation allows disclosure of confidential memory contents from RRAS-enabled Windows servers, potentially exposing credentials, tokens, or configuration data usable in follow-on attacks.
Affected Products
- Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012 and Windows Server 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54095 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54095
Vulnerability Analysis
The flaw resides in Windows Routing and Remote Access Service (RRAS), a Windows Server role that provides routing, VPN, and dial-up connectivity. RRAS parses complex network protocol structures across PPTP, L2TP, SSTP, and related protocols. An out-of-bounds read [CWE-125] occurs when the service processes malformed protocol data and reads beyond the bounds of an allocated buffer.
Because the attack vector is network-based and no authentication is required, an unauthorized attacker can reach the vulnerable code path remotely. The exploit path requires user interaction, so the attacker typically must convince a user to initiate a connection to an attacker-controlled server that returns crafted responses. The impact is limited to information disclosure — integrity and availability are not affected.
Root Cause
The root cause is missing or insufficient bounds checking in the RRAS protocol parsing logic. When the service dereferences a length field or offset supplied by a peer without validating that the value stays within the allocated buffer, it reads adjacent process memory. That memory may contain uninitialized data, heap metadata, cryptographic material, or session state.
Attack Vector
The attacker hosts a malicious RRAS or remote access endpoint and induces a target user to connect. During connection setup, the attacker returns crafted protocol frames with manipulated length or offset fields. The RRAS client-side handler on the target reads out-of-bounds memory and reflects a portion of it back to the attacker in subsequent protocol responses or errors. The attacker collects the leaked bytes across repeated interactions.
No verified public exploit or proof-of-concept is available at the time of writing. Refer to the Microsoft Security Update CVE-2025-54095 for authoritative technical details.
Detection Methods for CVE-2025-54095
Indicators of Compromise
- Outbound RRAS, PPTP (TCP/1723), L2TP (UDP/1701), or SSTP (TCP/443) connections initiated by servers or workstations toward untrusted external endpoints.
- Repeated short-lived RRAS sessions to the same remote host, consistent with iterative memory-leak harvesting.
- Unexpected crashes or exception logs in rasman.exe, svchost.exe hosting RRAS, or related remote access binaries.
Detection Strategies
- Monitor process telemetry for RRAS-related services making outbound connections to non-corporate infrastructure.
- Correlate Windows Event Log entries from the RemoteAccess and Rasman providers with network flow data to identify anomalous connection patterns.
- Alert on user-initiated VPN or dial-up connections to newly observed or low-reputation domains and IP addresses.
Monitoring Recommendations
- Enable and centralize RRAS diagnostic logging and forward it to a SIEM for retention and correlation.
- Track patch state for the September 2025 Microsoft security updates across all Windows Server assets that host or use RRAS.
- Baseline normal RRAS peer destinations and generate alerts on deviations, particularly for administrator accounts.
How to Mitigate CVE-2025-54095
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-54095 advisory to all affected Windows Server versions.
- Inventory systems with the RRAS role installed and prioritize patching internet-exposed or VPN-facing hosts first.
- Restrict outbound RRAS, PPTP, L2TP, and SSTP traffic from servers to only known, trusted endpoints.
Patch Information
Microsoft released fixes for CVE-2025-54095 as part of the September 2025 update cycle. Updates cover Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Consult the Microsoft Security Update CVE-2025-54095 advisory for KB article numbers matching each product build.
Workarounds
- Disable the Routing and Remote Access Service on servers where the role is not required for business operations.
- Block PPTP (TCP/1723), L2TP (UDP/1701, UDP/500, UDP/4500), and SSTP (TCP/443 to non-trusted hosts) at the perimeter firewall where feasible.
- Enforce administrator training to avoid initiating remote access connections to untrusted or unsolicited endpoints, since exploitation requires user interaction.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
