CVE-2026-25173: 
vulnerability analysis and mitigation

CVE-2026-25173 is an integer overflow/wraparound vulnerability in the Windows Routing and Remote Access Service (RRAS) that allows an authorized, low-privileged attacker to execute arbitrary code over a network. Disclosed on March 10, 2026, as part of Microsoft's Patch Tuesday, it affects a broad range of Windows versions including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server editions (2012, 2012 R2, 2016, 2019, 2022, 2025). It carries a CVSS v3.1 base score of 8.0 (High) (Microsoft MSRC).

The vulnerability is rooted in an integer overflow or wraparound condition (CWE-190) in the RRAS service, which subsequently triggers a heap-based buffer overflow (CWE-122) when processing malformed network input. An attacker with low privileges who can interact with the RRAS service over the network can supply crafted input that causes an arithmetic overflow, leading to an undersized heap allocation and subsequent memory corruption. Exploitation requires user interaction (UI:R) and low privileges (PR:L), limiting the attack surface compared to fully unauthenticated vulnerabilities, but the network attack vector (AV:N) makes it reachable remotely (Microsoft MSRC, Feedly).

Successful exploitation results in remote code execution with the privileges of the affected user, impacting confidentiality, integrity, and availability — all rated High. An attacker who achieves code execution on a Windows system running RRAS could access sensitive data, modify system configurations, or use the compromised host as a pivot point for lateral movement within the network. The broad scope of affected products — spanning consumer Windows 10/11 and multiple Windows Server generations — significantly widens the potential attack surface (Microsoft MSRC).

1. Reconnaissance: Identify Windows systems with RRAS enabled and exposed to the network using tools such as Shodan, Censys, or internal network scanners. Target systems running unpatched versions of Windows 10, Windows 11, or Windows Server editions prior to the March 10, 2026 patch.
2. Obtain low-privilege access: Acquire valid low-privilege credentials or a session on the target network, as the vulnerability requires authenticated (low-privilege) access and some form of user interaction.
3. Craft malicious RRAS input: Construct a specially crafted network request or data payload targeting the RRAS service that triggers the integer overflow condition, causing an arithmetic wraparound in a size calculation.
4. Trigger heap buffer overflow: The overflowed integer results in an undersized heap buffer allocation; subsequent data writes overflow the buffer, corrupting adjacent heap memory.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow, ultimately executing arbitrary code with the privileges of the RRAS service or the affected user account, enabling further post-exploitation activity such as credential harvesting or lateral movement (Microsoft MSRC, onsec.io).

• Network: Unusual or malformed inbound connections to RRAS service ports (TCP 1723 for PPTP, UDP 500/4500 for IKEv2, TCP 1701 for L2TP) from unexpected source IPs; anomalous outbound connections from the RRAS host to unknown external addresses.
• Process: Unexpected child processes spawned by the RRAS service (svchost.exe hosting rasman or remoteaccess), such as cmd.exe, powershell.exe, wscript.exe, or network utilities like curl, wget, or certutil.
• Logs: Windows Event Log entries (System/Security) showing RRAS service crashes, restarts, or access errors; Application event log entries indicating heap corruption or unhandled exceptions in RRAS-related DLLs.
• File System: Newly created or modified files in system directories (%SystemRoot%\System32\) by the RRAS service account; presence of unexpected scripts, executables, or web shells dropped post-exploitation.
• Registry: Unexpected modifications to RRAS-related registry keys under HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess or HKLM\SYSTEM\CurrentControlSet\Services\RasMan.

Microsoft released patches on March 10, 2026 as part of Patch Tuesday, with minimum fixed versions as follows: Windows 10 1607/Server 2016 → 10.0.14393.8957; Windows 10 1809/Server 2019 → 10.0.17763.8511; Windows 10 21H2 → 10.0.19044.7058; Windows 10 22H2 → 10.0.19045.7058; Windows 11 23H2 → 10.0.22631.6783; Windows 11 24H2 → 10.0.26100.7979; Windows 11 25H2 → 10.0.26200.7979; Windows 11 26H1 → 10.0.28000.1719; Server 2012 → 6.2.9200.25973; Server 2012 R2 → 6.3.9600.23074; Server 2022 → 10.0.20348.4830; Server 2022 23H2 → 10.0.25398.2207; Server 2025 → 10.0.26100.32463. Microsoft additionally released an out-of-band hotpatch (KB5084597) for Windows 11 24H2/25H2 managed devices to accelerate remediation. As a workaround where patching is not immediately possible, restrict RRAS service access to authorized users only, apply network-level controls to limit exposure of RRAS ports, and apply the principle of least privilege to RRAS service accounts (Microsoft MSRC, BleepingComputer).

The vulnerability received notable coverage following Microsoft's March 2026 Patch Tuesday, with security outlets including BleepingComputer, Rapid7, Sophos, and Computerworld reporting on the RRAS RCE flaws and the subsequent out-of-band hotpatch release (BleepingComputer, Rapid7). The Zero Day Initiative (ZDI) included it in their March 2026 Security Update Review (ZDI). The issuance of an emergency out-of-band hotpatch for Windows 11 enterprise managed devices drew particular attention, signaling Microsoft's concern about exploitation risk. Community discussion on Reddit and security forums highlighted the urgency of patching given the active exploitation reports.