CVE-2025-62472: Windows 10 1607 Privilege Escalation Flaw

CVE-2025-62472 Overview

CVE-2025-62472 is a local privilege escalation vulnerability in the Windows Remote Access Connection Manager (RasMan) service. The flaw stems from the use of an uninitialized resource, which an authenticated local attacker can leverage to elevate privileges to SYSTEM. Microsoft published the advisory on December 9, 2025, and the issue affects a broad range of Windows client and server versions, from Windows Server 2008 through Windows 11 25H2 and Windows Server 2025. Successful exploitation grants full control over confidentiality, integrity, and availability on the target host.

Critical Impact
An authorized local attacker can escalate to SYSTEM privileges on any unpatched Windows host running the Remote Access Connection Manager service, enabling full compromise of the endpoint.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Both x86 and x64 editions where applicable

Discovery Timeline

2025-12-09 - CVE-2025-62472 published to NVD
2025-12-09 - Microsoft releases security update for CVE-2025-62472
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62472

Vulnerability Analysis

The Remote Access Connection Manager (RasMan) service manages dial-up and VPN connections and runs as LocalSystem. CVE-2025-62472 arises when the service consumes an uninitialized resource during connection-related operations. Because the resource is not deterministically initialized before use, an attacker who can influence its contents controls a value that the privileged service subsequently trusts.

The advisory categorizes the weakness under CWE-416, reflecting memory-safety handling in the affected component. The NVD description frames the defect as use of an uninitialized resource, which allows an authenticated local user to manipulate service state that is later dereferenced or acted upon with SYSTEM privileges.

Exploitation requires local access and low privileges but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability on the compromised host. The EPSS score of 2.075% places this vulnerability in the 79th percentile of exploit likelihood, indicating elevated risk relative to the average CVE.

Root Cause

The root cause is a code path in RasMan that reads from or acts upon a resource before it has been fully initialized. A local, authenticated attacker can prepare conditions that leave the resource in an attacker-controlled or predictable state at the moment RasMan consumes it. The privileged service then operates on that data, providing the primitive needed for elevation.

Attack Vector

The attack vector is local. An attacker requires an authenticated shell on the target Windows host and the ability to interact with the RasMan service through documented RPC interfaces or connection APIs. No user interaction is required. Because RasMan runs as LocalSystem, a successful trigger elevates the attacker from a standard user context to full SYSTEM privileges, enabling credential theft, persistence, and lateral movement.

No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-62472

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the RasMan service (svchost.exe hosting RasMan).
Creation of new local administrator accounts, scheduled tasks, or services shortly after RasMan process anomalies.
Unusual child processes spawned by svchost.exe hosting RasMan, particularly cmd.exe, powershell.exe, or LOLBins running as SYSTEM.

Detection Strategies

Hunt for local user processes making unusual RPC calls to the Remote Access Connection Manager interface followed by privilege changes.
Correlate Sysmon Event ID 1 (process creation) with Event ID 4688 to flag SYSTEM-level processes parented by RasMan-hosting svchost.exe after non-administrative user activity.
Monitor Windows Event Log channel Microsoft-Windows-RasClient/Operational for anomalous connection API invocations from low-privilege sessions.

Monitoring Recommendations

Ensure endpoint telemetry captures service crashes, process lineage, and token elevation events on all Windows hosts.
Track patch compliance for the December 2025 Microsoft security updates across the fleet and alert on hosts missing the fix.
Baseline normal RasMan usage in your environment so anomalous invocations from non-VPN users stand out.

How to Mitigate CVE-2025-62472

Immediate Actions Required

Apply the December 2025 Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2025-62472 to all affected Windows client and server systems.
Prioritize patching multi-user systems, jump hosts, terminal servers, and any host where untrusted users can obtain interactive or remote logon.
Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of potential attackers.

Patch Information

Microsoft released fixes for CVE-2025-62472 on December 9, 2025, across all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Consult the Microsoft Security Update Guide for the specific KB article and build numbers that apply to each affected SKU. Legacy operating systems such as Windows Server 2008 and 2012 require the corresponding Extended Security Update (ESU) packages.

Workarounds

Where dial-up and VPN client functionality are not required, disable the RasMan service using sc.exe config RasMan start= disabled followed by sc.exe stop RasMan.
Restrict interactive and Remote Desktop logon rights via Group Policy so only trusted administrators can reach vulnerable hosts.
Apply application control policies (WDAC or AppLocker) to block unauthorized binaries that a local attacker would stage prior to triggering the flaw.

bash

# Configuration example: disable RasMan where VPN/dial-up is not needed
sc.exe stop RasMan
sc.exe config RasMan start= disabled

# Verify service state
sc.exe query RasMan