CVE-2024-43565: Windows 10 1507 NAT DoS Vulnerability

CVE-2024-43565 Overview

CVE-2024-43565 is a denial of service vulnerability affecting the Windows Network Address Translation (NAT) component across supported Windows client and server platforms. The flaw is categorized under [CWE-125] (Out-of-bounds Read) and can be triggered remotely without authentication or user interaction. A successful attack disrupts the availability of the NAT service, which can interrupt network connectivity for hosts that depend on it.

Microsoft published the advisory on October 8, 2024, as part of its monthly security updates. The vulnerability impacts Windows 10, Windows 11, and Windows Server releases from 2016 through 2022 (including 23H2).

Critical Impact
A remote, unauthenticated attacker can send crafted network traffic to a vulnerable Windows NAT service and cause a denial of service condition, degrading or disabling network address translation for connected systems.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43565 published to NVD and addressed in Microsoft's October 2024 security update
2025-03-28 - Last updated in NVD database

Technical Details for CVE-2024-43565

Vulnerability Analysis

The vulnerability resides in the Windows NAT driver, which handles translation of IP addresses and ports for traffic passing between networks. The CWE-125 classification indicates the driver performs an out-of-bounds read while parsing or processing network packets. When the read crosses an unintended memory boundary, the affected code path can fault or terminate the service, resulting in a denial of service.

Because the attack vector is network-based and requires no privileges or user interaction, an attacker only needs network reachability to a vulnerable NAT endpoint. The impact is limited to availability — confidentiality and integrity are not affected — but loss of NAT translation can disrupt downstream clients on internal networks, container hosts, and Hyper-V virtual switches that rely on NAT.

Root Cause

The root cause is improper validation of input lengths or offsets within a packet parsing routine in the NAT component. The driver reads memory beyond the bounds of an allocated buffer, leading to a crash of the kernel-mode component responsible for translation. Microsoft has not publicly released field-level technical details of the vulnerable function.

Attack Vector

An unauthenticated attacker sends a malformed packet sequence to a Windows host running the NAT service or exposing a NAT-translated interface. The crafted traffic triggers the out-of-bounds read in the NAT driver, terminating or destabilizing the service. No verified public proof-of-concept exists at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft CVE-2024-43565 Update Guide for vendor technical details.

Detection Methods for CVE-2024-43565

Indicators of Compromise

Unexpected termination or repeated restarts of the Windows NAT driver (winnat.sys) or related NAT services
Sudden loss of outbound connectivity for clients behind a Windows NAT host or Hyper-V NAT virtual switch
System event log entries indicating kernel-mode driver faults associated with networking components

Detection Strategies

Monitor Windows Event Log channels (System and Microsoft-Windows-Kernel-General) for driver crash and bug check events tied to NAT components
Inspect inbound traffic to NAT-enabled interfaces for malformed or anomalous packet patterns using network sensors or IDS signatures
Correlate NAT service restart events with concurrent ingress traffic spikes to identify potential exploitation attempts

Monitoring Recommendations

Track patch deployment status for the October 2024 Microsoft security updates across all Windows endpoints and servers
Alert on repeated availability loss of NAT-dependent workloads such as Hyper-V guests and Windows containers using a default NAT network
Baseline normal NAT translation table behavior and alert on sudden drops or service-stop events

How to Mitigate CVE-2024-43565

Immediate Actions Required

Apply the Microsoft October 2024 security update to all affected Windows 10, Windows 11, and Windows Server systems
Prioritize patching of hosts that act as NAT gateways, Hyper-V hosts using internal NAT switches, and container hosts using Windows NAT networking
Restrict network exposure of NAT-enabled interfaces to trusted segments using host firewall rules or upstream ACLs

Patch Information

Microsoft released a fix for CVE-2024-43565 as part of the October 8, 2024 security update cycle. Administrators should consult the Microsoft CVE-2024-43565 Update Guide to identify the correct KB article for each affected Windows build and deploy the corresponding cumulative update.

Workarounds

Disable the Windows NAT service (winnat) on hosts where NAT functionality is not required until patching is completed
Place vulnerable hosts behind a perimeter firewall that blocks untrusted traffic to NAT-facing interfaces
Segment Hyper-V and container networks so that NAT-translated interfaces are not reachable from untrusted networks

bash

# Example: temporarily stop and disable the Windows NAT service on a host where NAT is not required
sc.exe stop winnat
sc.exe config winnat start= disabled

# Re-enable after patching
sc.exe config winnat start= auto
sc.exe start winnat