cbcvebase.
CVE-2025-33066
published 2025-06-10

CVE-2025-33066: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.95%
57.3th percentile
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

Affected

47 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.2103410.0.10240.21034
microsoftwindows_10_1607< 10.0.14393.814810.0.14393.8148
microsoftwindows_10_1809< 10.0.17763.743410.0.17763.7434
microsoftwindows_10_21h2< 10.0.19044.596510.0.19044.5965
microsoftwindows_10_22h2< 10.0.19045.596510.0.19045.5965
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2103410.0.10240.21034
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.814810.0.14393.8148
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.743410.0.17763.7434
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.596510.0.19044.5965
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.596510.0.19045.5965
microsoftwindows_11_22h2< 10.0.22621.547210.0.22621.5472
microsoftwindows_11_23h2< 10.0.22631.547210.0.22631.5472
microsoftwindows_11_24h2< 10.0.26100.427010.0.26100.4270
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.547210.0.22621.5472
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.547210.0.22631.5472
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.547210.0.22631.5472
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.434910.0.26100.4349
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.277696.1.7601.27769
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.233516.0.6003.23351
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.255226.2.9200.25522
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.226206.3.9600.22620
microsoftwindows_server_2016< 10.0.14393.814810.0.14393.8148
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.814810.0.14393.8148

Detection & IOCsextracted from sources · hover to see the quote

  • Attack vector is network-based and requires user interaction; a client must connect to a malicious server. Monitor for RRAS client connections to unexpected or external servers.
  • Exploitation path involves a malicious server returning crafted data to trigger a heap-based buffer overflow in the RRAS client. Inspect RRAS traffic for anomalous or oversized response payloads.
  • The vulnerability is a heap-based buffer overflow in Windows RRAS (svchost-hosted service). Monitor for unexpected crashes or heap corruption events in the RRAS service process.
  • ·Exploitation is currently assessed as unlikely; no public exploit or active exploitation has been confirmed as of the advisory date.
  • ·User interaction is required for exploitation (UI:R per CVSS), meaning the attack cannot be fully automated without social engineering a user to initiate a connection to a malicious server.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.