CVE-2026-71351: Windows RRAS Privilege Escalation Flaw

CVE-2026-71351 Overview

CVE-2026-71351 is a double free vulnerability [CWE-415] in the Windows Routing and Remote Access Service (RRAS). An authorized local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

The issue affects the memory management logic within RRAS, which handles routing, VPN, and dial-up connectivity on Windows systems. Successful exploitation grants the attacker higher privileges than initially assigned, potentially reaching SYSTEM-level access on the local host.

Critical Impact
A local, authorized attacker who wins a required race condition can trigger memory corruption in RRAS and elevate privileges, gaining full confidentiality, integrity, and availability impact on the affected Windows host.

Affected Products

Microsoft Windows (Routing and Remote Access Service component)
Windows Server installations with RRAS role enabled
Refer to the Microsoft Security Update CVE-2026-71351 advisory for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-71351 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71351

Vulnerability Analysis

The vulnerability is a double free condition within the Windows Routing and Remote Access Service. A double free occurs when the same memory allocation is released more than once, corrupting heap metadata and creating conditions for controlled memory reuse.

An attacker with valid local credentials can interact with RRAS interfaces in a sequence that causes the service to release the same allocation twice. The resulting heap corruption can be shaped to overwrite function pointers or object headers, redirecting execution within a privileged process context.

Because RRAS typically runs with elevated privileges, successful exploitation escalates the attacker from a standard authenticated account to SYSTEM. Exploitation requires winning a timing-sensitive condition, which raises the practical attack complexity.

Root Cause

The root cause is improper tracking of allocation ownership in RRAS memory handling paths. When the same pointer is freed on two independent code paths, the heap allocator's internal state is corrupted, enabling an attacker to influence subsequent allocations and induce a use-after-free style primitive.

Attack Vector

Exploitation requires local access and low-privileged authenticated credentials. No user interaction is needed. The attacker sends crafted requests or triggers specific state transitions in RRAS to reach the vulnerable free path twice against the same object.

Detailed proof-of-concept code is not publicly available. See the Microsoft Security Update CVE-2026-71351 advisory for vendor technical details.

Detection Methods for CVE-2026-71351

Indicators of Compromise

Unexpected crashes or Watson error reports referencing the RRAS service (svchost.exe hosting RemoteAccess)
Creation of new local administrator accounts or scheduled tasks following RRAS service instability
Anomalous child processes spawned from the RRAS service host with SYSTEM privileges

Detection Strategies

Monitor Windows Event Log for RRAS service crashes, restarts, and application error events tied to heap corruption
Alert on privilege elevation events where the parent process chain traces back to the RRAS service host
Correlate low-privileged user sessions with subsequent SYSTEM-level process creation on the same host

Monitoring Recommendations

Enable command-line auditing and process creation logging (Event ID 4688) with parent process tracking
Forward Windows Defender or endpoint telemetry to a centralized SIEM for cross-host correlation
Track configuration changes to the RRAS role and any unexpected enablement on servers that should not host the service

How to Mitigate CVE-2026-71351

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-71351 advisory to all affected Windows systems
Inventory all servers with the RRAS role enabled and prioritize patching for internet-adjacent and multi-user hosts
Restrict local logon rights to reduce the pool of accounts capable of triggering the flaw

Patch Information

Microsoft has released a security update addressing CVE-2026-71351. Administrators should consult the Microsoft Security Update CVE-2026-71351 page for build-specific KB articles and deployment guidance. Apply the update through Windows Update, WSUS, or the Microsoft Update Catalog.

Workarounds

Disable the Routing and Remote Access Service on systems that do not require VPN, routing, or dial-up functionality
Enforce least-privilege policies and remove interactive logon rights from accounts that do not require them
Apply application allowlisting to limit which binaries unprivileged users can execute on RRAS-enabled hosts

bash

# Disable the RRAS service on hosts that do not require it (PowerShell, run as administrator)
Stop-Service -Name RemoteAccess -Force
Set-Service -Name RemoteAccess -StartupType Disabled
Get-Service -Name RemoteAccess