CVE-2026-65672: Windows Remote Access Privilege Escalation

CVE-2026-65672 Overview

CVE-2026-65672 is a heap-based buffer overflow [CWE-122] in the Windows Remote Access API. An authorized local attacker can trigger the overflow to elevate privileges on the affected system. Microsoft published the advisory on 2026-08-11 and assigned a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The flaw affects confidentiality, integrity, and availability once exploited. Successful exploitation grants the attacker elevated privileges on the local Windows host, enabling further post-compromise activity such as credential theft or persistence installation.

Critical Impact
A local authorized user can corrupt heap memory in the Windows Remote Access API to gain higher privileges, resulting in full compromise of the affected host.

Affected Products

Microsoft Windows (Remote Access API component)
Specific Windows versions and builds listed in the Microsoft Security Response Center advisory
Systems where the Remote Access service or API is reachable to a local authenticated user

Discovery Timeline

2026-08-11 - CVE-2026-65672 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65672

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow [CWE-122] within the Windows Remote Access API. The API handles remote-access related requests, and improperly bounded write operations to a heap-allocated buffer allow an attacker to overwrite adjacent memory. Corruption of heap metadata or adjacent objects can be leveraged to hijack control flow or manipulate privileged data structures.

Exploitation requires local access and low-privilege authentication. No user interaction is needed, and the attack complexity is low. The impact scope stays within the affected component, but successful exploitation yields high impact across confidentiality, integrity, and availability.

The EPSS probability is 0.264% (18th percentile) as of 2026-08-13, indicating limited near-term exploitation forecast. However, elevation-of-privilege bugs in core Windows components historically attract post-compromise use by threat actors chaining a prior code execution primitive with a local privilege escalation.

Root Cause

The root cause is insufficient validation of an input size or count value before copying attacker-influenced data into a heap-allocated buffer within the Remote Access API. When the effective write length exceeds the allocation, adjacent heap memory is corrupted. Microsoft's advisory is the authoritative source for the exact routine and structure involved.

Attack Vector

The attack vector is local. An authenticated user with low privileges invokes the vulnerable Remote Access API path with crafted input that produces an out-of-bounds heap write. Control-flow hijacking or targeted overwrite of security-relevant structures then results in privilege elevation to a higher context, such as SYSTEM.

No verified public proof-of-concept code is available. Refer to the Microsoft CVE-2026-65672 Advisory for vendor technical details.

Detection Methods for CVE-2026-65672

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries referencing Remote Access service binaries or the rasapi component
Creation of new privileged processes spawned by a previously non-privileged user session
Anomalous loading of Remote Access API modules by user-mode processes that do not typically consume the API

Detection Strategies

Monitor for process token elevation events where a low-privileged user session obtains SYSTEM-level tokens without a legitimate elevation path
Correlate Remote Access service crash telemetry with subsequent process creation events under elevated integrity levels
Apply behavioral detection rules focused on heap corruption exploitation patterns and post-exploitation privilege changes

Monitoring Recommendations

Ingest Windows Security, System, and Application event logs into a central SIEM for cross-event correlation
Track Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for suspicious parent-child chains involving Remote Access components
Alert on repeated service crashes of Remote Access-related services followed by privilege changes on the same host within a short time window

How to Mitigate CVE-2026-65672

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-65672 Advisory to all affected Windows systems
Prioritize patching on multi-user systems, jump hosts, and terminal servers where local authenticated access is broadest
Audit accounts with interactive logon rights and remove unnecessary local access

Patch Information

Microsoft has released updates through the Security Update Guide. Consult the Microsoft CVE-2026-65672 Advisory for the specific KB articles, affected builds, and download links applicable to each Windows version in your environment.

Workarounds

Restrict interactive and local logon rights to trusted administrators until patches are deployed
Disable the Routing and Remote Access Service (RemoteAccess) on hosts where it is not required
Enforce application control policies to limit which binaries can invoke the Remote Access API on sensitive systems

bash

# Query and stop the Routing and Remote Access service on hosts where it is not needed
sc.exe query RemoteAccess
sc.exe stop RemoteAccess
sc.exe config RemoteAccess start= disabled