CVE-2025-21368: Windows 10 1507 Digest Auth RCE Flaw

CVE-2025-21368 Overview

CVE-2025-21368 is a remote code execution vulnerability in the Microsoft Digest Authentication component of Windows. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and affects a broad range of Windows client and server releases. An authenticated network attacker can exploit the issue to execute arbitrary code in the context of the targeted service. Microsoft published the advisory on February 11, 2025 as part of its security update guide.

Critical Impact
Successful exploitation allows attackers with low-privilege network access to execute arbitrary code, compromising confidentiality, integrity, and availability of the affected Windows system.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-02-11 - CVE-2025-21368 published to NVD
2025-02-11 - Microsoft releases security update for CVE-2025-21368
2025-02-26 - Last updated in NVD database

Technical Details for CVE-2025-21368

Vulnerability Analysis

The vulnerability resides in the Microsoft Digest Authentication protocol implementation on Windows. Digest Authentication is a challenge-response authentication mechanism used by HTTP and SASL-aware Windows services. The flaw is a heap-based buffer overflow [CWE-122] triggered when the component processes specially crafted authentication data over the network.

The attack requires low privileges and no user interaction. An authenticated attacker on the network sends malformed Digest Authentication messages to a vulnerable endpoint. The component fails to validate input sizes before copying data into a heap buffer, corrupting adjacent memory. With reliable heap shaping, the attacker can hijack control flow and execute code in the security context of the affected service.

Because the attack vector is network-based and the scope is unchanged, exploitation can occur remotely against any reachable service that consumes the Digest Authentication component. The current EPSS probability is 0.307% (53.9th percentile).

Root Cause

The root cause is improper bounds checking during the parsing of attacker-controlled fields inside Digest Authentication exchanges. The implementation allocates a fixed-size heap region and copies user-supplied data without verifying length constraints, producing a classic heap-based buffer overflow.

Attack Vector

The attacker must hold valid low-privilege credentials on the network and reach a Windows service that uses Digest Authentication. The attacker then sends crafted authentication requests carrying oversized or malformed fields. Successful corruption of heap structures yields arbitrary code execution. Microsoft has not published technical exploitation details. See the Microsoft Security Update Guide for CVE-2025-21368 for vendor analysis.

Detection Methods for CVE-2025-21368

Indicators of Compromise

Unexpected service crashes or restarts in processes that handle Digest Authentication, such as lsass.exe or web service worker processes.
Anomalous Digest Authentication requests containing oversized header fields or malformed nonce, cnonce, or response parameters.
Authenticated network sessions from low-privilege accounts followed by new child processes or outbound connections from authentication-related services.

Detection Strategies

Inspect HTTP and SASL traffic for Digest Authentication headers that exceed expected field lengths or contain non-standard encodings.
Correlate authentication events in Security (Event ID 4624/4625) with subsequent service crashes (Event ID 7031, 7034) on the same host.
Hunt for process lineage anomalies where authentication services spawn shells, scripting hosts, or network tools.

Monitoring Recommendations

Forward Windows Security, System, and Sysmon logs to a centralized analytics platform for cross-host correlation.
Baseline normal Digest Authentication usage in the environment and alert on deviations in volume, source, or request structure.
Monitor for unexpected loading of authentication-related DLLs or memory protection changes in processes that consume Digest Authentication.

How to Mitigate CVE-2025-21368

Immediate Actions Required

Apply the February 2025 Microsoft security update for every affected Windows client and server SKU listed in the advisory.
Inventory systems still running legacy releases such as Windows Server 2008 and 2012 and prioritize their remediation or isolation.
Restrict network access to services that accept Digest Authentication using firewall rules and network segmentation.
Rotate credentials for low-privilege accounts that could be abused to reach vulnerable endpoints.

Patch Information

Microsoft released fixes through the Security Update Guide on February 11, 2025. Refer to the Microsoft advisory for CVE-2025-21368 for the KB articles and cumulative updates that apply to each affected build. Patches must be installed on all listed Windows 10, Windows 11, and Windows Server versions.

Workarounds

Disable Digest Authentication on services where it is not required, falling back to stronger mechanisms such as Kerberos or modern token-based authentication.
Enforce network-level authentication and IPsec to limit which hosts can initiate authentication exchanges with sensitive services.
Apply the principle of least privilege so that compromised low-privilege accounts cannot reach internal authentication endpoints.

bash

# Configuration example: audit and remove Digest Authentication on IIS
Import-Module WebAdministration
Get-WebConfigurationProperty -Filter "/system.webServer/security/authentication/digestAuthentication" -PSPath "IIS:\" -Name enabled
Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/digestAuthentication" -PSPath "IIS:\" -Name enabled -Value $false