CVE-2026-85794 in Windows
Summary
by MITRE • 10/14/2026
Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified involves a critical out-of-bounds read flaw within the Microsoft Windows Routing and Remote Access Service, commonly referred to as RRAS. This service is responsible for managing network routing protocols and remote access connections on Windows Server systems. The specific technical defect arises when the application processes certain input data structures without adequate validation of memory boundaries. Consequently, an attacker who has already gained authorized local access can trigger this condition by crafting a malicious request or payload that causes RRAS to read from a memory location outside its allocated buffer. This type of error is classically categorized under CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of the intended buffer.
The operational impact of this vulnerability centers on information disclosure rather than direct code execution or privilege escalation at the initial stage. By exploiting the memory leak inherent in an out-of-bounds read, a local attacker can extract sensitive data from the process memory space of the RRAS service. This disclosed information may include cryptographic keys, session tokens, internal network configurations, or other credentials stored within the application's runtime environment. While the attack requires prior authorization to reach this point, it significantly lowers the barrier for further exploitation by providing attackers with valuable intelligence that can facilitate lateral movement or deeper compromise of the host system and connected networks.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1005, which covers Data from Local System. The attacker leverages local access to gather information about the compromised environment, using the leaked data as a stepping stone for subsequent attacks such as credential dumping or network reconnaissance. Because RRAS often handles sensitive routing and authentication traffic, the exposure of internal state can have broader implications for network security integrity beyond just the individual server instance.
Mitigation strategies should prioritize immediate patching through official Microsoft update channels to apply the latest security fixes that address this memory handling defect. Administrators must ensure that all Windows Server systems running RRAS are updated to versions containing the specific patches for this CVE. In environments where updating is not immediately feasible, strict access controls should be enforced to limit local user privileges on affected servers. Principle of least privilege dictates that only essential administrative accounts should have login rights to machines hosting critical infrastructure services like RRAS. Additionally, deploying endpoint detection and response solutions can help monitor for anomalous memory access patterns or unusual data exfiltration behaviors associated with this type of exploitation attempt.