CVE-2025-21369: Windows 10 1507 Digest Auth RCE Flaw

CVE-2025-21369 Overview

CVE-2025-21369 is a remote code execution vulnerability in the Microsoft Digest Authentication component shipped with supported Windows client and server operating systems. Microsoft assigned a CVSS 3.1 base score of 8.8 and mapped the underlying weakness to a heap-based buffer overflow [CWE-122]. The flaw is network-reachable, requires low attack complexity, and needs only low-privilege authentication, with no user interaction. Successful exploitation lets an attacker execute arbitrary code in the context of the Digest Authentication process and compromise confidentiality, integrity, and availability of the host.

Critical Impact
An authenticated network attacker can trigger a heap-based buffer overflow in Microsoft Digest Authentication and execute arbitrary code on affected Windows systems, leading to full host compromise.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-02-11 - CVE-2025-21369 published to NVD
2025-02-26 - Last updated in NVD database

Technical Details for CVE-2025-21369

Vulnerability Analysis

The vulnerability resides in Microsoft Digest Authentication, an HTTP authentication mechanism historically used to negotiate credentials between clients and servers without sending the password in cleartext. Microsoft tracks the issue as a remote code execution flaw rooted in a heap-based buffer overflow [CWE-122]. When the Digest Authentication code processes attacker-controlled fields during the authentication exchange, it writes beyond the bounds of a heap buffer. That out-of-bounds write corrupts adjacent heap metadata or object pointers and provides a primitive for arbitrary code execution in the context of the authenticating process. The advisory indicates that the attacker must already hold valid low-privilege credentials, which means the bug is well-suited to lateral movement after an initial foothold rather than fully unauthenticated internet exposure.

Root Cause

The root cause is improper bounds validation in heap memory used by the Digest Authentication component when parsing or assembling protocol fields. Microsoft has not published structural detail beyond the Microsoft CVE-2025-21369 Advisory, but the CWE-122 classification points to a fixed-size or miscalculated heap allocation receiving more data than its capacity permits.

Attack Vector

The attack vector is network-based. An authenticated adversary sends crafted Digest Authentication traffic to a vulnerable Windows host, triggering the heap overflow and gaining code execution at the privilege level of the affected service. Because the scope is unchanged, the resulting code execution runs in the same security context as the vulnerable component rather than crossing a trust boundary on its own.

No public proof-of-concept or in-the-wild exploitation has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the current EPSS value indicates a low near-term exploitation probability. See the security advisory for additional technical details.

Detection Methods for CVE-2025-21369

Indicators of Compromise

Unexpected crashes, exceptions, or restarts in services that invoke wdigest.dll or the Digest Security Support Provider on Windows endpoints and servers.
Anomalous inbound Digest Authentication exchanges from internal hosts that do not normally initiate such traffic, particularly outside business hours.
Post-authentication process spawns from authentication-handling processes that deviate from baseline parent-child relationships.

Detection Strategies

Hunt for malformed or oversized Digest Authentication headers in HTTP and SSPI-based traffic captured at proxies, WAFs, and host telemetry.
Correlate failed and successful authentication events with subsequent process creation events on the same host to surface post-auth code execution.
Apply behavioral identification rules that flag heap corruption signals such as access violations followed by suspicious child processes from authentication services.

Monitoring Recommendations

Forward Windows Security, Sysmon, and authentication provider logs to a centralized analytics platform and retain them long enough to reconstruct the full authentication chain.
Monitor for newly created local accounts, service installations, or scheduled tasks following Digest Authentication activity on servers that expose authenticated endpoints.
Track patch state of wdigest.dll and related authentication components across the fleet and alert when affected builds reappear after reimaging.

How to Mitigate CVE-2025-21369

Immediate Actions Required

Apply the February 2025 Microsoft security updates referenced in the Microsoft CVE-2025-21369 Advisory to all affected Windows client and server builds.
Prioritize patching on domain controllers, application servers, and any host that accepts Digest Authentication from the network.
Audit credential hygiene and rotate passwords for low-privilege service and user accounts that could be abused to satisfy the authentication prerequisite.

Patch Information

Microsoft has released security updates for all listed Windows 10, Windows 11, and Windows Server versions, including Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025. Administrators should consult the Microsoft Security Response Center entry for the exact KB identifiers that apply to each build and ensure the updates are deployed via Windows Update, WSUS, or their configuration management tooling.

Workarounds

Disable Digest Authentication on services and applications where it is not required, and prefer Kerberos or modern token-based authentication.
Restrict network access to authentication endpoints using host firewalls, network segmentation, and identity-aware proxies to limit who can reach the vulnerable surface.
Enforce least privilege so that compromised low-privilege accounts have minimal lateral movement value while patching is in progress.

bash

# Configuration example: disable Digest Authentication on an IIS site
# (run from an elevated PowerShell prompt on the affected web server)
Import-Module WebAdministration
Set-WebConfigurationProperty `
  -Filter "/system.webServer/security/authentication/digestAuthentication" `
  -Name "enabled" `
  -Value "False" `
  -PSPath "IIS:\" `
  -Location "Default Web Site"