CVE-2026-85808: Windows RRAS Out-of-Bounds Read DOS Flaw

CVE-2026-85808 Overview

CVE-2026-85808 is an out-of-bounds read vulnerability [CWE-125] in the Windows Routing and Remote Access Service (RRAS). An unauthenticated remote attacker can send crafted network traffic to a vulnerable RRAS endpoint and trigger a denial-of-service condition. The flaw affects availability only, with no impact to confidentiality or integrity. Exploitation requires no user interaction and no prior privileges on the target. Microsoft published the advisory in its Security Update Guide and assigned the issue to the RRAS component of Windows.

Critical Impact
Unauthenticated network attackers can crash or disrupt the Windows RRAS service, interrupting VPN, dial-up, and routing functionality for all connected clients.

Affected Products

Microsoft Windows with the Routing and Remote Access Service (RRAS) role enabled
Windows Server deployments acting as VPN or routing gateways
See the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85808 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85808

Vulnerability Analysis

The vulnerability resides in the Windows Routing and Remote Access Service, a role that provides routing, dial-up, and VPN connectivity on Windows Server. RRAS parses several network protocols on behalf of remote clients, and the flaw stems from an out-of-bounds read during this parsing path. When the service processes a malformed packet, it reads memory beyond the bounds of an allocated buffer. The read triggers an access violation that terminates or disrupts the RRAS process, denying service to legitimate clients. The attack is network-reachable and requires no authentication or user interaction. Because RRAS commonly fronts VPN gateways, a crash removes remote-access connectivity for every tunneled user.

Root Cause

The root cause is improper validation of input length or offset fields during RRAS packet handling, classified under [CWE-125] Out-of-bounds Read. The parser trusts attacker-supplied size or index values and dereferences memory outside the valid buffer region. Microsoft has not published the specific internal function or protocol handler responsible. Refer to the Microsoft Security Update Guide for component-level details.

Attack Vector

An attacker sends a crafted packet across the network to a Windows host exposing RRAS. The service reads memory outside the intended buffer, raises an unhandled exception, and terminates. No credentials, prior foothold, or user action are required. Systems exposing RRAS to the internet, such as VPN concentrators, present the highest exposure. No public proof-of-concept exploit is currently available, and the EPSS probability stands at 1.149%.

No verified exploit code is public for this issue. See the vendor advisory for technical specifics.

Detection Methods for CVE-2026-85808

Indicators of Compromise

Unexpected termination or repeated restarts of the RemoteAccess service on Windows hosts
Windows Event Log entries referencing access violations in svchost.exe instances hosting RRAS
Loss of VPN or routing connectivity for multiple clients within a short window
Inbound traffic to RRAS listeners (for example, PPTP TCP/1723, L2TP UDP/1701, SSTP TCP/443) from untrusted sources immediately preceding a service crash

Detection Strategies

Correlate Windows Service Control Manager events (Event ID 7031, 7034) for the RemoteAccess service with network telemetry targeting RRAS ports
Monitor Windows Error Reporting and Application Error logs for faults in RRAS-related modules
Alert on anomalous packet patterns against RRAS endpoints, especially malformed or truncated protocol headers

Monitoring Recommendations

Baseline normal RRAS uptime and packet volume, then alert on deviations
Forward Windows Application, System, and Security event logs to a central SIEM for correlation
Track external exposure of RRAS ports using continuous attack surface monitoring

How to Mitigate CVE-2026-85808

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build
Inventory all Windows hosts with the Routing and Remote Access role enabled and prioritize internet-facing systems
Restrict inbound access to RRAS protocols to known client networks using host and perimeter firewalls

Patch Information

Microsoft addresses CVE-2026-85808 through the monthly Windows security updates. Consult the Microsoft Security Update Guide for the specific KB article and build numbers that correspond to each supported version of Windows and Windows Server. Apply the update through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management tooling.

Workarounds

Disable the Routing and Remote Access Service on hosts where it is not required
Place RRAS endpoints behind a VPN concentrator or firewall that filters malformed traffic at the perimeter
Limit source IP ranges that can reach RRAS listeners to trusted branch offices or client networks

bash

# Example: disable RRAS where unused (run in elevated PowerShell)
Stop-Service RemoteAccess
Set-Service RemoteAccess -StartupType Disabled

# Example: restrict inbound RRAS ports to a trusted subnet
New-NetFirewallRule -DisplayName "Restrict RRAS SSTP" -Direction Inbound `
  -Protocol TCP -LocalPort 443 -RemoteAddress 10.0.0.0/8 -Action Allow