CVE-2025-21313: Windows 11 24H2 SAM DOS Vulnerability

CVE-2025-21313 Overview

CVE-2025-21313 is a denial of service vulnerability in the Windows Security Account Manager (SAM). The flaw affects Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025. An authenticated attacker on the network can exploit the issue to disrupt availability of the SAM service. The weakness is categorized under [CWE-833] (Deadlock), indicating a concurrency flaw in how the component handles competing requests. Microsoft published the advisory on January 14, 2025 as part of its monthly security release.

Critical Impact
Successful exploitation causes a high-availability impact on the Windows SAM subsystem, which manages local account authentication data and underpins core authentication workflows.

Affected Products

Microsoft Windows 11 24H2
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-01-14 - CVE-2025-21313 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21313

Vulnerability Analysis

The Security Account Manager is a Windows subsystem that stores and manages local user and group account information. It services authentication requests through documented remote procedure call interfaces. CVE-2025-21313 allows an authenticated remote attacker to trigger a condition that renders the SAM service unresponsive. Because SAM is foundational to local authentication, disruption affects downstream services that depend on account lookups and credential validation.

Root Cause

The vulnerability maps to [CWE-833] Deadlock. A deadlock occurs when two or more threads hold resources the other needs and neither can proceed. In the SAM context, concurrent or malformed requests can place internal locks into a state where handling threads block indefinitely. The service stops responding to new requests until it is restarted.

Attack Vector

Exploitation requires network access and valid low-privileged credentials. No user interaction is required. An attacker authenticates to the target and issues crafted requests against the SAM interface to trigger the deadlock condition. The result is loss of availability for the SAM service without any direct impact to confidentiality or integrity. Microsoft has not reported active exploitation, and no public proof-of-concept exploit is listed for CVE-2025-21313.

Technical details beyond Microsoft's advisory are not publicly documented. Refer to the Microsoft CVE-2025-21313 Update Guide for vendor-specific guidance.

Detection Methods for CVE-2025-21313

Indicators of Compromise

Repeated authenticated connections from a single source to the SAM remote procedure call interface followed by service unresponsiveness.
Windows event log entries showing SamSs service hangs, restarts, or client-side RPC timeouts to SAM endpoints.
Spikes in failed account lookup operations or authentication delays on domain members and standalone hosts.

Detection Strategies

Monitor for anomalous volumes of MS-SAMR RPC traffic from non-administrative accounts.
Correlate SAM service state changes with recent authenticated sessions to identify the source principal.
Baseline normal SAM query patterns per host and alert on deviations consistent with a denial of service attempt.

Monitoring Recommendations

Collect Windows System and Security event logs centrally and alert on SamSs service stop or hang events.
Enable RPC auditing where feasible and ingest telemetry into a SIEM for correlation across hosts.
Track authentication latency metrics on domain controllers and member servers to detect degradation early.

How to Mitigate CVE-2025-21313

Immediate Actions Required

Apply the January 2025 Microsoft security updates to all affected Windows 11 24H2, Windows Server 2022 23H2, and Windows Server 2025 systems.
Inventory exposed hosts using the CPE identifiers from the NVD record to confirm patch coverage.
Restrict network reachability of SMB and RPC endpoints to trusted management networks only.

Patch Information

Microsoft released fixes for CVE-2025-21313 on January 14, 2025. Administrators should consult the Microsoft CVE-2025-21313 Update Guide for the correct cumulative update identifiers for each affected build. Apply updates through Windows Update, Windows Server Update Services, or an enterprise patch management workflow.

Workarounds

No vendor-provided workaround is listed. Patching is the authoritative remediation.
Enforce the principle of least privilege and disable unused local accounts to reduce the authenticated attack surface.
Segment management traffic and limit SMB and RPC exposure to internal, authenticated networks using host-based firewall rules.

bash

# Example: verify installed updates on an affected host
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

# Example: restrict inbound SMB to trusted subnets
New-NetFirewallRule -DisplayName "Restrict SMB to Mgmt" -Direction Inbound \
  -Protocol TCP -LocalPort 445 -RemoteAddress 10.0.0.0/24 -Action Allow