Microsoft disclosed two elevation-of-privilege vulnerabilities in Windows Remote Access Connection Manager this week, both rated Important.
The flaws could enable authenticated local attackers to gain elevated privileges on affected systems.
The vulnerabilities were released on December 9, 2025, and require local access with low privileges to exploit.
Both affect the Remote Access Connection Manager component and stem from improper access control and memory management issues.
Attackers exploiting these flaws would need existing user access on the target system. However, no interaction from victims is necessary for successful exploitation.
| CVE ID | Affected Component | Vulnerability Type | Severity Rating | CVSS v3.1 Score |
|---|---|---|---|---|
| CVE-2025-62474 | Windows Remote Access Connection Manager | Elevation of Privilege | Important | 7.8 / 6.8 |
| CVE-2025-62472 | Windows Remote Access Connection Manager | Elevation of Privilege | Important | 7.8 / 6.8 |
The first vulnerability, CVE-2025-62474, stems from improper access controls within the component.
The weakness allows attackers to bypass security restrictions and escalate their privileges to higher levels on the system.
CVE-2025-62472 results from two separate memory management flaws: use of uninitialized resources and use-after-free conditions.
Both memory issues could be leveraged to achieve similar privilege escalation outcomes.
Both vulnerabilities share identical CVSS v3.1 base scores of 7.8, indicating high impact potential.
The attack vector is local, the attack complexity is low, and the privileges required are minimal.
Neither flaw requires user interaction for exploitation. Organizations should prioritize patching these vulnerabilities across their Windows infrastructure.
Microsoft internally assigned these vulnerabilities, and both are tracked on CVE.org. The attack complexity remains low, suggesting attackers with basic technical skills could develop functional exploits.
The elevation of privilege impact means successful attacks could result in complete system compromise. IT administrators should apply security updates as soon as they become available.
Windows administrators should monitor official Microsoft security advisories for patch deployment information and timelines.
The vulnerabilities affect local authenticated access scenarios, making internal network security and access controls critical mitigations.
Organizations with elevated privilege user accounts should review and restrict unnecessary elevated access permissions.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
