Unpatched Windows RasMan Flaw Allows Unprivileged Crash, Enabling Local System Privilege Escalation Exploit

Researchers at 0patch have identified an unpatched vulnerability in the Windows Remote Access Connection Manager (RasMan) service, discovered while investigating CVE-2025-59230, an elevation of privilege vulnerability Microsoft addressed in its October 2025 updates. The flaw hinges on a race condition in RasMan that allows an unprivileged user to crash the service on demand, a capability described as essential to exploiting the prior CVE-2025-59230 flaw.

0patch traced the issue to a circular linked list where a NULL pointer is not properly handled, causing an immediate memory access violation and a service crash. Microsoft has been alerted and will likely provide an official patch for still-supported Windows versions in a future update, while 0patch has released an immediate micropatch to close the hole.

Micropatches are available for a wide range of systems, including Windows 11 (v21H2 through v25H2), Windows 10, and legacy systems such as Windows 7 and Server 2008 R2.