CVE-2024-49113: Windows 10 1507 LDAP DoS Vulnerability

CVE-2024-49113 Overview

CVE-2024-49113 is a denial of service vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) service. The flaw affects all supported versions of Windows and Windows Server, including domain controllers running the LDAP service. An unauthenticated remote attacker can send crafted LDAP traffic that triggers an out-of-bounds read [CWE-125], causing the Local Security Authority Subsystem Service (LSASS) to crash and force a system reboot.

The vulnerability carries an EPSS score of 88.639% (99.52 percentile), indicating substantial real-world exploitation likelihood. Microsoft addressed the issue in the December 2024 Patch Tuesday release.

Critical Impact
An unauthenticated attacker with network access to a domain controller can crash LSASS and trigger automatic reboots, disrupting authentication services across the affected Active Directory environment.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 24H2)
Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2024-12-12 - CVE-2024-49113 published to NVD
2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-49113

Vulnerability Analysis

The vulnerability resides in the LDAP client/server processing logic within the Windows directory services stack. When the LDAP service parses a malformed response or referral, it performs an out-of-bounds read on memory it does not own. The read operation references memory beyond an allocated buffer boundary, leading to an access violation inside LSASS.exe.

Because LSASS is a protected process critical to authentication, an unhandled exception in this process triggers an immediate system reboot. On a domain controller, this disables Kerberos, NTLM, and LDAP authentication for every client relying on the affected server.

The attack does not require credentials, user interaction, or local access. A single crafted LDAP referral response is sufficient to trigger the crash.

Root Cause

The root cause is improper bounds validation when processing LDAP protocol structures, classified as an out-of-bounds read [CWE-125]. Insufficient length checks on attacker-controlled fields permit the parser to read past the end of a heap buffer during message deserialization.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker induces a vulnerable Windows host to perform an LDAP query against an attacker-controlled server, then returns a malicious referral response. Public technical write-ups describe coercing the victim through a DCE/RPC DsrGetDcNameEx2 call combined with a poisoned DNS SRV record, but any path that causes the target to issue an outbound LDAP request and process a hostile response is viable.

No verified proof-of-concept code is referenced in the NVD entry. Refer to the Microsoft Security Update for CVE-2024-49113 for vendor details.

Detection Methods for CVE-2024-49113

Indicators of Compromise

Unexpected LSASS.exe crashes recorded in the Application event log with faulting module references to Wldap32.dll
Automatic system reboots on domain controllers following inbound or outbound LDAP traffic
Windows Error Reporting entries citing access violations originating in LDAP client routines
Anomalous DNS SRV queries for _ldap._tcp followed by connections to non-corporate LDAP endpoints

Detection Strategies

Monitor Windows Event IDs 1000 and 1001 for LSASS.exe faults paired with LDAP module names
Alert on unscheduled domain controller reboots, particularly correlated with inbound RPC or LDAP traffic
Inspect outbound LDAP (TCP/389, TCP/636, TCP/3268) connections from servers to non-trusted networks
Hunt for DCE/RPC calls invoking DsrGetDcNameEx2 from untrusted sources

Monitoring Recommendations

Enable verbose LSA and Netlogon logging on domain controllers to capture referral processing failures
Forward Windows security and system event logs to a centralized SIEM with correlation rules for repeated LSASS crashes
Baseline normal LDAP query patterns and alert on deviation, including queries to unknown external hosts

How to Mitigate CVE-2024-49113

Immediate Actions Required

Apply the December 2024 Microsoft security update to all Windows endpoints and Windows Server systems, prioritizing domain controllers
Inventory all systems running LDAP services and confirm patch deployment status through configuration management tooling
Restrict outbound LDAP traffic from domain controllers to only trusted, internal directory services

Patch Information

Microsoft released patches addressing CVE-2024-49113 as part of the December 2024 Patch Tuesday cycle. Patch details and download links are available from the Microsoft Security Response Center advisory. Apply the cumulative update corresponding to each affected Windows or Windows Server version.

Workarounds

Block outbound LDAP and LDAPS connections from domain controllers to untrusted networks at the perimeter firewall
Filter inbound RPC traffic targeting Netlogon and directory services interfaces from external or untrusted segments
Restrict DNS resolution paths so domain controllers cannot resolve attacker-controlled SRV records for _ldap._tcp
Enable Windows Defender Firewall rules that limit which hosts may initiate LDAP sessions with the server

bash

# Configuration example: block outbound LDAP from a domain controller to non-trusted networks
New-NetFirewallRule -DisplayName "Block Outbound LDAP to Untrusted" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 389,636,3268,3269 `
  -RemoteAddress 0.0.0.0/0 `
  -Action Block `
  -Profile Any