Microsoft Windows RRAS Heap-Based Buffer Overflow Vulnerability Allowing Remote Code Execution

A heap-based buffer overflow vulnerability has been identified in the Windows Routing and Remote Access Service (RRAS). This vulnerability allows an unauthorized attacker to execute code remotely over the network. It affects multiple versions of Windows Server, including 2012, 2008 R2, 2016, 2022, and 2019, as well as Windows Server 2025. The vulnerability arises because the RRAS Snap-in can be manipulated to send requests to a malicious server, potentially leading to arbitrary code execution on the user's system.

Impact

Exploitation of this vulnerability could result in remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, an unauthorized attacker must set up a malicious server and wait for a user to connect to it via the RRAS Snap-in. Once the connection is established, the server can send malicious data that exploits the buffer overflow, leading to code execution on the user's system.

Remediation

Users can apply the security updates provided by Microsoft for their specific Windows Server version. These security updates can be downloaded via the Microsoft Update Catalog.