SB2026011392 - Multiple vulnerabilities in Microsoft Windows Routing and Remote Access Service (RRAS)

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-20843)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in Windows Routing and Remote Access Service (RRAS). A local user can bypass implemented security restrictions and gain elevated privileges on the target system.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-20868)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows Routing and Remote Access Service (RRAS). A remote attacker can trick a victim into sending a request to a malicious server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20843
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20868