CVE-2026-71343

CVE-2026-71343 is a heap-based buffer overflow (CWE-122) in the Windows Remote Access Connection Manager service (RasMan). It is triggered by an authorized, low-privileged local user interacting with the service, and requires no user interaction or remote network access. Successful exploitation lets the attacker execute code on the affected host, with high impact on confidentiality, integrity, and availability per the CVSS score of 7.8. Any Windows system running the Remote Access Connection Manager service is affected; the specific affected Windows editions and version ranges were not included in the source data and should be confirmed in Microsoft's advisory. As of this analysis there is no known exploitation, no public proof-of-concept, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Apply Microsoft's security update for CVE-2026-71343 promptly and verify the exact affected Windows editions/versions in Microsoft's advisory. Because exploitation requires an already-authorized local user, prioritize hosts with multiple or untrusted local logons (terminal/RDP servers, shared workstations) and restrict local logon rights to trusted accounts on sensitive systems until patched.