Microsoft Windows Remote Access API: Privilege Escalation to SYSTEM via a User-Controlled Custom Dialer Loaded on Hang-Up

Presentation

The Remote Access API (rasapi32.dll) manages dial-up and VPN connections on every Windows edition. Each user keeps a personal phonebook, rasphone.pbk in the roaming profile, and an entry of that phonebook can name a custom dialer DLL (CustomDialDll) that RAS calls to dial the connection and to hang it up.

HDW Sec found that the hang-up path loads that DLL, taken from the phonebook of the user, inside a SYSTEM service. A standard user who owns a connection can disconnect it through the Network Connections COM interface, served by netman in the LocalSystem RasMan service host, which reaches rasapi32!DwCustomHangUp and loads the DLL of the user there.

Microsoft rates the issue Important, scores it 7.8 (temporal 6.8) with a local attack vector and low privileges, records the impact as elevation of privilege to SYSTEM, and assesses exploitation as more likely.

Issue(s)

• A RAS phonebook entry stores the path of a custom dialer in CustomDialDll. In the per-user phonebook (%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk), the user sets that value freely, through RasSetEntryProperties or by editing the file.
• The dial path vets the custom dialer, so the entry is dialed with the field empty. While the connection is coming up, the user flags it as using a custom dialer by raising its custom-dial reference count (rasman!RasReferenceCustomCount), then writes the path of its own DLL into CustomDialDll once the connection is established. The trust decision is taken at dial time and never revisited at hang-up time.
• The user then calls INetConnection::Disconnect on that connection. The Connection Manager object is served by netman.dll inside the LocalSystem RasMan svchost.exe, and its launch permission grants Interactive Users, so a standard user can drive it. netman impersonates the caller to read the caller’s phonebook, then hangs the connection up, and rasapi32!DwCustomHangUp loads the CustomDialDll path with LoadLibraryExW and calls its RasCustomHangUp export with the SYSTEM token of the service.
• The library is resolved from data the user controls instead of a trusted location, which Microsoft classifies as CWE-426 (untrusted search path). HDW Sec tracks it the same way: a privileged process loads a DLL whose path comes from the unprivileged caller.
• Confirmed live on Windows 11 as a standard, non-administrator user, without any UAC prompt, service restart or pre-existing VPN: the RasCustomHangUp export of the planted DLL ran inside the RasMan svchost.exe under a SYSTEM process token at System integrity level, wrote a file into C:\Windows\System32 and started an interactive SYSTEM command prompt. The call stack captured from the DLL runs from netman.dll through RASAPI32.dll into the planted library.
• The connection has to come up for the hang-up path to run, so the user needs a VPN endpoint it can reach, its own PPTP server for instance. The tunnel traffic itself plays no role, and the user creates the entry in its own phonebook.
• Microsoft assigns the exploitability index “Exploitation More Likely” and reports the vulnerability as neither publicly disclosed nor exploited at publication.
• The Remote Access API is part of the operating system, so the fix comes in the monthly cumulative update of each Windows version, and in the Hotpatch updates for the versions that receive them (rasapi32.dll is among the files patched by Hotpatch KB5132043). Every supported branch is affected, from Windows 10 version 1607 and Windows Server 2016 to Windows 11 version 26H2 and Windows Server 2025.

References

• Microsoft Security Update Guide: CVE-2026-119853
• MITRE record: CVE-2026-119853
• Fix delivered in the Windows cumulative updates of 2026-11-10: KB5132061 for Windows 11 version 26H2, 25H2 and 24H2 (builds 10.0.26300.9974, 10.0.26200.9974 and 10.0.26100.9974), or Hotpatch KB5132043 (builds 10.0.26300.9911, 10.0.26200.9911 and 10.0.26100.9911), KB5132059 for Windows 11 version 26H1 (build 10.0.28000.3501), KB5131087 for Windows 11 version 23H2 (build 10.0.22631.7711), KB5131096 for Windows 10 version 22H2 and 21H2 (builds 10.0.19045.7846 and 10.0.19044.7846), KB5131085 for Windows 10 version 1809 and Windows Server 2019 (build 10.0.17763.9487), KB5131291 for Windows 10 version 1607 and Windows Server 2016 (build 10.0.14393.9688), KB5131080 for Windows Server 2025 (build 10.0.26100.33822), or Hotpatch KB5131077 (build 10.0.26100.33730), and KB5131090 for Windows Server 2022 (build 10.0.20348.5870)