_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
_________________________/\\\\\\\\\\\______________________________________________________________________________________________________________________________________ _______________________/\\\/////////\\\____________________________________________________________________________________________________________________________________ ______________________\//\\\______\///____________________________________________________________/\\\_____/\\\_________/\\\__/\\\_________________________________________ _______________________\////\\\_____________/\\\\\\\\______/\\\\\\\\__/\\\____/\\\__/\\/\\\\\\\__\///___/\\\\\\\\\\\___\//\\\/\\\__________________________________________ __________________________\////\\\________/\\\/////\\\___/\\\//////__\/\\\___\/\\\_\/\\\/////\\\__/\\\_\////\\\////_____\//\\\\\___________________________________________ _____________________________\////\\\____/\\\\\\\\\\\___/\\\_________\/\\\___\/\\\_\/\\\___\///__\/\\\____\/\\\__________\//\\\____________________________________________ ______________________/\\\______\//\\\__\//\\///////___\//\\\________\/\\\___\/\\\_\/\\\_________\/\\\____\/\\\_/\\___/\\_/\\\_____________________________________________ _____________________\///\\\\\\\\\\\/____\//\\\\\\\\\\__\///\\\\\\\\_\//\\\\\\\\\__\/\\\_________\/\\\____\//\\\\\___\//\\\\/______________________________________________ _______________________\///////////_______\//////////_____\////////___\/////////___\///__________\///______\/////_____\////________________________________________________ _____________________________________________/\\\\\\\\\\\__________________/\\\_______________________________________________________________________________________________________ ___________________________________________/\\\/////////\\\_______________\/\\\_______________________________________________________________________________________________________ __________________________________________\//\\\______\///________________\/\\\_________________________/\\\_______________________________________/\\\_______________________________ ___________________________________________\////\\\__________/\\\____/\\\_\/\\\_________/\\\\\\\\\\__/\\\\\\\\\\\__/\\/\\\\\\\___/\\\\\\\\\_____/\\\\\\\\\\\_____/\\\\\\\\____________ ______________________________________________\////\\\______\/\\\___\/\\\_\/\\\\\\\\\__\/\\\//////__\////\\\////__\/\\\/////\\\_\////////\\\___\////\\\////____/\\\/////\\\___________ _________________________________________________\////\\\___\/\\\___\/\\\_\/\\\////\\\_\/\\\\\\\\\\____\/\\\______\/\\\___\///____/\\\\\\\\\\_____\/\\\_______/\\\\\\\\\\\____________ __________________________________________/\\\______\//\\\__\/\\\___\/\\\_\/\\\__\/\\\_\////////\\\____\/\\\_/\\__\/\\\__________/\\\/////\\\_____\/\\\_/\\__\//\\///////_____________ _________________________________________\///\\\\\\\\\\\/___\//\\\\\\\\\__\/\\\\\\\\\___/\\\\\\\\\\____\//\\\\\___\/\\\_________\//\\\\\\\\/\\____\//\\\\\____\//\\\\\\\\\\___________ ___________________________________________\///////////______\/////////___\/////////___\//////////______\/////____\///___________\////////\//______\/////______\//////////____________
cve

CVE-2025-64678: Windows RRAS Remote Code Execution

Security Substrate

— 5 min read

CVE ID: CVE-2025-64678

Severity: HIGH | CVSS: 8.8

Sources: 2 different security sources

Let Me Explain What Happened

Let me walk you through this one carefully, because it's important. Microsoft has disclosed a serious vulnerability in Windows Routing and Remote Access Service—that's RRAS for short. Think of RRAS as the traffic controller for network connections in Windows servers. The problem here is a heap-based buffer overflow, which is like someone stuffing too much mail into a mailbox until it breaks open. When that happens, an attacker can potentially take control of your system remotely, without needing any special privileges to start with.

This vulnerability was first published by the National Vulnerability Database on December 9, 2025, and Microsoft updated their guidance on January 14, 2026. What makes this particularly concerning is that an attacker can exploit this over the network—they don't need to be sitting at your computer.

A Bit More Detail

Here's what's happening under the hood: When RRAS processes certain network requests, it doesn't properly validate how much data it's receiving. This allows an attacker to send specially crafted packets that overflow a memory buffer on the heap. Once they've overflowed that buffer, they can potentially execute their own code with the same privileges as the RRAS service. The good news, if we can call it that, is that this does require some user interaction—the attack isn't completely silent. The bad news is that with a CVSS score of 8.8, this is rated as HIGH severity for good reason.

The Technical Specifics

  • Attack Vector: Network (AV:N) - Can be exploited remotely over a network connection
  • Attack Complexity: Low (AC:L) - Doesn't require special conditions to exploit
  • Privileges Required: None (PR:N) - Attacker doesn't need any initial access
  • User Interaction: Required (UI:R) - Some user action is needed for exploitation
  • Impact: High confidentiality, integrity, and availability impact (C:H/I:H/A:H)
  • Affected Products: Windows systems running Routing and Remote Access Service (RRAS)
  • CWE: CWE-122 (Heap-based Buffer Overflow)
  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Understanding Buffer Overflows

Let me explain what a heap-based buffer overflow means in practical terms. Your computer's memory has different areas where it stores information. The "heap" is like a workspace where programs request memory as they need it. When a program asks for space to store, say, 100 characters, but then someone sends it 200 characters without proper checking, those extra 100 characters spill over into adjacent memory areas. It's like filling a cup so full that it overflows onto the table—except in this case, an attacker can carefully control what that "overflow" contains, potentially including malicious instructions that the computer then executes.

CWE-122 specifically refers to this type of overflow happening in heap memory, which is particularly dangerous because heap memory is dynamically allocated and can be manipulated in ways that give attackers significant control over program execution.

What You Should Do About This

  • Right Now:
    • Identify Exposure: Determine which of your Windows systems are running RRAS. You can check this by opening Services (services.msc) and looking for "Routing and Remote Access." If it's running and set to automatic, you're potentially exposed.
    • Review Access: If you're running RRAS, review who has network access to these services. Consider implementing network segmentation to limit exposure until you can patch.
    • Monitor Logs: Check your Windows Event Logs for unusual RRAS activity. Look for unexpected connection attempts or service crashes that might indicate exploitation attempts.
    • Temporary Mitigation: If you don't actively need RRAS, consider disabling the service temporarily until you can apply patches. Only do this if it won't disrupt critical business operations.
  • For the Long Term:
    • Apply Security Updates: Microsoft has released security updates to address this vulnerability. Visit the Microsoft Security Response Center update guide at the link provided below and apply the appropriate patches for your Windows versions. Microsoft updated the build numbers on January 14, 2026, so make sure you're getting the latest version.
    • Test Before Deploying: As always, test these updates in a non-production environment first. RRAS is a critical networking component, and you want to ensure the patches don't disrupt your routing configurations.
    • Implement Defense in Depth: Don't rely solely on patching. Use network firewalls to restrict access to RRAS services only from trusted networks. Implement intrusion detection systems that can identify buffer overflow attempts.
    • Regular Vulnerability Scanning: Make sure your vulnerability management program includes regular scans for missing patches, especially for network-facing services like RRAS.

Detection and Hunting Guidance

If you're a security analyst or system administrator looking to detect potential exploitation attempts, here's what to watch for:

  • Windows Event Logs: Monitor Event ID 20103 (RRAS service errors) and Event ID 20111 (authentication failures) in the System log. Unusual patterns or crashes could indicate exploitation attempts.
  • Network Traffic: Look for malformed or oversized packets destined for RRAS services (typically TCP port 1723 for PPTP or UDP port 500 for IPsec). Your IDS/IPS should be configured to detect buffer overflow signatures.
  • Memory Dumps: If RRAS crashes unexpectedly, preserve the memory dump for forensic analysis. Buffer overflow attempts often leave distinctive patterns in memory.
  • Process Monitoring: Watch for unusual child processes spawned by the RRAS service (svchost.exe hosting RemoteAccess). Successful exploitation might result in unexpected process creation.

Going Deeper: MITRE ATT&CK Context

For those of you who map threats to the MITRE ATT&CK framework, this vulnerability aligns with several techniques:

  • T1210 - Exploitation of Remote Services: The primary technique, as attackers exploit RRAS over the network
  • T1068 - Exploitation for Privilege Escalation: Successful exploitation could lead to elevated privileges
  • T1499 - Endpoint Denial of Service: Failed exploitation attempts might crash the RRAS service

Understanding these mappings helps you correlate this vulnerability with your broader threat detection and response strategies. If you're seeing indicators of T1210 activity in your environment, this CVE should be on your radar for investigation.

Timeline of Disclosure

Here's how this vulnerability came to light:

  • December 9, 2025: CVE-2025-64678 published by the National Vulnerability Database with a CVSS score of 8.8. The Zero Day Initiative included this in their December 2025 Security Update Review, noting it as part of Microsoft's final Patch Tuesday of 2025.
  • January 14, 2026: Microsoft Security Response Center published an informational update, revising the affected build numbers. This suggests Microsoft refined their understanding of which specific Windows builds are vulnerable.

Why This Matters

You might be wondering why a vulnerability requiring user interaction still rates as HIGH severity. Let me explain my thinking here. While user interaction does reduce the likelihood of exploitation compared to a fully remote attack, RRAS is a service that handles network connections—often automatically and in the background. The "user interaction" required might be as simple as a user's system processing a network request, which happens constantly in normal operations. Combined with the fact that no privileges are required to initiate the attack and it can be done over the network, this creates a significant risk profile.

Additionally, RRAS is commonly used in enterprise environments for VPN connections and routing between networks. A compromise here could give an attacker a foothold in your network infrastructure, which is why defense in depth is so important.

Where I Found This Information

Note: This is automated security intelligence based on multiple sources. Always test updates carefully before applying them everywhere. The information provided here is current as of January 14, 2026, based on available sources. Security situations evolve rapidly, so please check the official Microsoft Security Response Center for the most current guidance.

Read more