CVE-2025-26672
📋 TL;DR
A buffer over-read vulnerability in Windows Routing and Remote Access Service (RRAS) allows unauthorized attackers to read beyond allocated memory boundaries, potentially disclosing sensitive information from system memory. This affects Windows systems with RRAS enabled, particularly those exposed to network traffic.
💻 Affected Systems
- Windows Routing and Remote Access Service
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive information from system memory, potentially exposing credentials, encryption keys, or other confidential data that could lead to further compromise.
Likely Case
Information disclosure of random memory contents, which could include fragments of sensitive data or system information useful for reconnaissance.
If Mitigated
Limited information disclosure with no direct code execution or system compromise.
🎯 Exploit Status
Exploitation requires sending specially crafted network packets to the RRAS service. No authentication is required, but attackers need network access to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific patch versions
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26672
Restart Required: Yes
Instructions:
1. Apply the latest Windows security updates from Microsoft. 2. Restart affected systems to complete the patch installation. 3. Verify RRAS service is running properly after restart.
🔧 Temporary Workarounds
Disable RRAS Service
windowsTemporarily disable the Routing and Remote Access Service if not required
sc config RemoteAccess start= disabled
net stop RemoteAccess
Network Segmentation
windowsRestrict network access to RRAS services using firewall rules
netsh advfirewall firewall add rule name="Block RRAS" dir=in action=block protocol=TCP localport=1723,1701,47,50,51
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with RRAS services
- Monitor RRAS service logs for unusual connection attempts or memory access patterns
🔍 How to Verify
Check if Vulnerable:
Check if RRAS service is enabled and running: sc query RemoteAccessCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history shows the relevant security patch installed and RRAS service version matches patched version📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service crashes or restarts
- Multiple connection attempts to RRAS ports from single sources
- Memory access violations in Windows Event Logs
Network Indicators:
- Unusual traffic patterns to RRAS ports (1723, 1701, 47, 50, 51)
- Multiple malformed packets sent to RRAS service
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName="RemoteAccess" OR ProcessName="svchost.exe" AND CommandLine LIKE "%RemoteAccess%"