CVE-2025-64678 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Api.Msrc.Microsoft • December 9, 2025

Share: View original

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in Windows RRAS Allow Remote Code Execution and Information Disclosure Three vulnerabilities have been identified in the Windows Routing and Remote Access Service (RRAS). CVE-2025-62549 and CVE-2025-64678 allow unauthorized remote code execution, while CVE-2025-62473 enables information disclosure. These vulnerabilities affect systems utilizing RRAS, potentially exposing them to attacks over a network. 3 sources 58

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)