CVE-2025-64678

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Published Dec 9, 2025 CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Description

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

Analysis

Technical impact

A heap‑based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute arbitrary code over a network connection. The vulnerability can compromise confidentiality, integrity, and availability of the affected system, giving the attacker full control of the host.

Affected Systems

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 22H3; Windows Server 2008 R2 Service Pack 1 (regular and Server Core), Windows Server 2008 Service Pack 2, Windows Server 2012 and 2012 R2 (regular and Server Core), Windows Server 2016, 2019, 2022, and 2025.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity, but the EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, likely meaning no confirmed exploits exist yet. The attack vector is inferred to be network‑based, requiring no special privileges and permitting remote code execution from an external actor.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Windows 10 Version 1607

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8594

Microsoft

Windows 10 Version 1809

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8027

Microsoft

Windows 10 Version 21H2

affected

Version	Status	Constraints
`10.0.19044.0`	affected	< 10.0.19044.6575

Microsoft

Windows 10 Version 22H2

affected

Version	Status	Constraints
`10.0.19045.0`	affected	< 10.0.19045.6575

Microsoft

Windows 11 version 22H3

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.6199

Microsoft

Windows 11 Version 23H2

affected

Version	Status	Constraints
`10.0.22631.0`	affected	< 10.0.22631.6199

Microsoft

Windows 11 Version 24H2

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.7171

Microsoft

Windows 11 Version 25H2

affected

Version	Status	Constraints
`10.0.26200.0`	affected	< 10.0.26200.7171

Microsoft

Windows Server 2008 R2 Service Pack 1

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.28021

Microsoft

Windows Server 2008 R2 Service Pack 1 (Server Core installation)

affected

Version	Status	Constraints
`6.1.7601.0`	affected	< 6.1.7601.28021

Microsoft

Windows Server 2008 Service Pack 2

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23624

Microsoft

Windows Server 2008 Service Pack 2 (Server Core installation)

affected

Version	Status	Constraints
`6.0.6003.0`	affected	< 6.0.6003.23624

Microsoft

Windows Server 2012

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25768

Microsoft

Windows Server 2012 (Server Core installation)

affected

Version	Status	Constraints
`6.2.9200.0`	affected	< 6.2.9200.25768

Microsoft

Windows Server 2012 R2

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22869

Microsoft

Windows Server 2012 R2 (Server Core installation)

affected

Version	Status	Constraints
`6.3.9600.0`	affected	< 6.3.9600.22869

Microsoft

Windows Server 2016

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8594

Microsoft

Windows Server 2016 (Server Core installation)

affected

Version	Status	Constraints
`10.0.14393.0`	affected	< 10.0.14393.8594

Microsoft

Windows Server 2019

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8027

Microsoft

Windows Server 2019 (Server Core installation)

affected

Version	Status	Constraints
`10.0.17763.0`	affected	< 10.0.17763.8027

Microsoft

Windows Server 2022

affected

Version	Status	Constraints
`10.0.20348.0`	affected	< 10.0.20348.4405

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

affected

Version	Status	Constraints
`10.0.25398.0`	affected	< 10.0.25398.1965

Microsoft

Windows Server 2025

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.7171

Microsoft

Windows Server 2025 (Server Core installation)

affected

Version	Status	Constraints
`10.0.26100.0`	affected	< 10.0.26100.7171

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_21h2::::::::
	cpe:2.3:o:microsoft:windows_10_22h2::::::::
	cpe:2.3:o:microsoft:windows_11_23h2::::::::
	cpe:2.3:o:microsoft:windows_11_24h2::::::::
	cpe:2.3:o:microsoft:windows_11_25h2::::::::
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:*
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022::::::::
	cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::
	cpe:2.3:o:microsoft:windows_server_2025::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Microsoft security update that addresses the RRAS heap‑overflow bug (CVE‑2025‑64678).
If the patch cannot be applied immediately, restrict inbound access to the RRAS service with firewall rules or place the host behind a demilitarized zone.
Disable the RRAS service on any system where it is not required to eliminate the attack surface.

Generated by OpenCVE AI on April 20, 2026 at 15:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.106% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64678

History

Jan 7, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Dec 10, 2025 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 Microsoft windows Server 2022 23h2
CPEs		cpe:2.3:o:microsoft:windows_10_1607:::::::x64:* cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::: cpe:2.3:o:microsoft:windows_10_22h2:::::::: cpe:2.3:o:microsoft:windows_11_23h2:::::::: cpe:2.3:o:microsoft:windows_11_24h2:::::::: cpe:2.3:o:microsoft:windows_11_25h2:::::::: cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x64:* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:::::x86:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:* cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2022_23h2::::::::
Vendors & Products		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 Microsoft windows Server 2022 23h2

Dec 9, 2025 6:15 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Title		Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025 Microsoft windows Server 23h2
Weaknesses		CWE-122
CPEs		cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_10_21H2:::::::x86:* cpe:2.3:o:microsoft:windows_10_22H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_23H2:::::::x64:* cpe:2.3:o:microsoft:windows_11_24H2:::::::arm64:* cpe:2.3:o:microsoft:windows_11_25H2:::::::arm64:* cpe:2.3:o:microsoft:windows_server_2008_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2008_sp2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012:::::::x64:* cpe:2.3:o:microsoft:windows_server_2012_R2:::::::x64:* cpe:2.3:o:microsoft:windows_server_2016:::::::: cpe:2.3:o:microsoft:windows_server_2019:::::::: cpe:2.3:o:microsoft:windows_server_2022:::::::: cpe:2.3:o:microsoft:windows_server_2025:::::::: cpe:2.3:o:microsoft:windows_server_23h2::::::::
Vendors & Products		Microsoft Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 Microsoft windows Server 2012 R2 Microsoft windows Server 2016 Microsoft windows Server 2019 Microsoft windows Server 2022 Microsoft windows Server 2025 Microsoft windows Server 23h2
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-64678
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

Subscriptions

Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 Windows 10 22h2 Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows Server 2008 Windows Server 2008 R2 Windows Server 2008 Sp2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025 Windows Server 23h2

Weaknesses