Microsoft Windows RRAS Buffer Over-read Vulnerability Allowing Information Disclosure

A buffer over-read vulnerability has been identified in the Windows Routing and Remote Access Service (RRAS). This vulnerability allows an unauthorized attacker to disclose information over the network by exploiting the buffer over-read condition, which could potentially lead to reading portions of heap memory.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure over the network.

Remediation

Users can download the security update for this vulnerability via the Microsoft Update Catalog. Security update KB5065425 is available for Windows Server 2022, 23H2 Edition (Server Core installation). For Windows Server 2012 R2, the security update KB5065507 is available. Windows Server 2016 users can download security update KB5065427. For Windows Server 2025, security updates KB5065426 and KB5065474 are available. Users running Windows Server 2022 (Server Core installation) can also download security update KB5065432.