CVE-2025-49674
Published: 08 July 2025
Summary
CVE-2025-49674 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-49674 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting the Windows Routing and Remote Access Service (RRAS). Published on 2025-07-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An unauthorized attacker can exploit this vulnerability over a network with low attack complexity and no required privileges, though user interaction is necessary. Successful exploitation enables arbitrary code execution on the target system.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49674 details available mitigations and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20641
Vulnerability details
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in RRAS enables remote arbitrary code execution against a network-accessible service (T1190/T1210).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the heap-based buffer overflow vulnerability in RRAS by requiring timely installation of vendor patches.
Implements memory safeguards like heap randomization and integrity checks to block arbitrary code execution from buffer overflow exploits in RRAS.
Restricts network traffic to RRAS service ports at boundaries, reducing unauthorized remote access opportunities for exploitation.