Executive SummaryMicrosoft has released a security update addressing a new heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS), tracked as CVE-2025-54113. The flaw could allow remote code execution (RCE) if exploited, and administrators are strongly urged to patch affected Windows Server systems immediately.
- Released: September 9, 2025 (Patch Tuesday)
- Impact: Remote Code Execution
- Severity: Important (CVSS 8.8)
- Weakness: CWE-122: Heap-based Buffer Overflow
- Exploitation: Not publicly disclosed, not exploited in the wild, exploitation rated "Unlikely"
According to Microsoft, exploitation requires tricking a user into connecting to a malicious RRAS server, which can then send crafted data to trigger the vulnerability.
Affected Products
This vulnerability affects multiple supported Windows Server versions, including:
- Windows Server 2008 SP2 / R2 SP1 (x64, 32-bit, Server Core)
- Windows Server 2012 / 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022 (standard, 23H2, Server Core)
- Windows Server 2025
Refer to Microsoft’s Security Update Guide for the exact KB article numbers and build updates for each edition.
Recommended Actions
- Patch Immediately: Apply the September 2025 cumulative security updates or standalone security-only updates as applicable.
- Mitigate if Patch Delayed:
- Disable or firewall RRAS services exposed to untrusted networks.
- Stop the RemoteAccess service if RRAS is not required.
- Detection Guidance:
- Monitor Windows Event Logs (
RemoteAccess,RasMan) for abnormal service behavior. - Use SIEM/EDR hunts for RRAS crashes, anomalous process launches, or unexpected network activity on VPN/RRAS ports (SSTP, L2TP, PPTP).
- Deploy IDS rules to flag malformed RRAS protocol traffic.
References
This update is part of a wider set of RRAS heap-based RCE vulnerabilities patched in 2025. Even if exploitation is rated unlikely today, history shows that unpatched RRAS systems exposed to the internet become high-value targets. Administrators should treat this patch with urgency and verify update deployment across all affected server versions.
