CVE-2025-50163
Published: 12 August 2025
Summary
CVE-2025-50163 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2025-50163 is a heap-based buffer overflow, also associated with out-of-bounds read issues, that affects the Windows Routing and Remote Access Service (RRAS). It carries a CVSS 3.1 score of 8.8 and was published in August 2025.
An unauthorized attacker can exploit the flaw over a network to execute arbitrary code. The attack requires no privileges and only limited user interaction, enabling high impacts to confidentiality, integrity, and availability on reachable Windows systems.
Mitigation details are addressed in the Microsoft Security Response Center advisory referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-50163.
The associated EPSS score remains low at 0.0113 with no material increase from its peak value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24348
Vulnerability details
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in the publicly accessible Windows RRAS service directly enables remote arbitrary code execution (T1190 Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the heap-based buffer overflow flaw in RRAS to prevent exploitation.
Implements memory protections like non-executable heap memory and address space randomization to block successful exploitation of the RRAS heap buffer overflow.
Mandates validation of network inputs to the RRAS service to mitigate malformed data triggering the heap-based buffer overflow.