CVE-2025-29836
📋 TL;DR
An out-of-bounds read vulnerability in Windows Routing and Remote Access Service (RRAS) allows unauthorized attackers to read sensitive memory contents over the network. This affects Windows systems with RRAS enabled, potentially exposing system information or credentials. The vulnerability requires network access to the RRAS service.
💻 Affected Systems
- Windows Routing and Remote Access Service (RRAS)
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive memory contents including credentials, cryptographic keys, or system information, leading to privilege escalation or lateral movement.
Likely Case
Information disclosure of system memory contents, potentially revealing configuration details or partial data that could aid further attacks.
If Mitigated
Limited information disclosure with no direct code execution, but still revealing system details that could inform targeted attacks.
🎯 Exploit Status
Requires network access to RRAS service and knowledge of triggering the out-of-bounds read condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB number
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29836
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft. 2. Verify RRAS service is updated. 3. Restart system if required by update.
🔧 Temporary Workarounds
Disable RRAS if not needed
windowsDisable Routing and Remote Access Service if not required for business operations
sc config RemoteAccess start= disabled
net stop RemoteAccess
Network segmentation
windowsRestrict network access to RRAS service using firewall rules
New-NetFirewallRule -DisplayName "Block RRAS" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Block
🧯 If You Can't Patch
- Disable RRAS service entirely if not required
- Implement strict network access controls to limit who can reach RRAS service
🔍 How to Verify
Check if Vulnerable:
Check if RRAS service is enabled and running on affected Windows versionsCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains the relevant security update and RRAS service version📡 Detection & Monitoring
Log Indicators:
- Unusual RRAS service crashes
- Multiple connection attempts to RRAS
- Event ID 20159 in RRAS logs
Network Indicators:
- Unusual traffic patterns to RRAS ports (typically 1723, 1701)
- Multiple malformed packets to RRAS service
SIEM Query:
source="windows" AND (service="RemoteAccess" OR event_id=20159) AND (keywords="error" OR "crash")