CVE-2025-26651: Windows 11 22h2 DoS Vulnerability

CVE-2025-26651 Overview

CVE-2025-26651 is a Denial of Service vulnerability in the Windows Local Session Manager (LSM) component that allows an authorized attacker to disrupt service availability over a network. The vulnerability stems from an exposed dangerous method or function (CWE-749) within the LSM service, which is responsible for managing local user sessions on Windows systems.

Critical Impact

Authenticated attackers can remotely trigger a denial of service condition against affected Windows systems, potentially disrupting critical business operations and user session management.

Affected Products

• Microsoft Windows 11 22H2
• Microsoft Windows 11 23H2
• Microsoft Windows 11 24H2
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2
• Microsoft Windows Server 2025

Discovery Timeline

• April 8, 2025 - CVE-2025-26651 published to NVD
• July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-26651

Vulnerability Analysis

The Windows Local Session Manager (LSM) is a critical Windows service (lsm.dll) that handles local user session management, including session creation, termination, and state tracking. This vulnerability exists due to an exposed dangerous method or function within the LSM component that can be invoked remotely by authenticated users.

When exploited, an attacker with valid credentials can leverage the exposed functionality to cause the LSM service to enter a denial of service state, disrupting session management capabilities on the affected system. This can impact user logins, session tracking, and other session-related operations.

The attack requires network access and low-privilege authentication, making it accessible to any user with valid credentials on the network. No user interaction is required to exploit this vulnerability, and the attack complexity is low.

Root Cause

The root cause of CVE-2025-26651 is classified as CWE-749: Exposed Dangerous Method or Function. This occurs when a software component exposes a method or function that can be leveraged by attackers to perform unintended operations. In this case, the LSM service exposes functionality that, when called with specific parameters or in certain conditions, leads to service disruption.

The exposed method allows authenticated network users to trigger operations that exhaust resources or cause the service to crash, resulting in denial of service conditions affecting session management on the target system.

Attack Vector

The vulnerability is exploitable over the network by an authenticated attacker. The attack does not require elevated privileges—any authenticated user with network access to the affected system can potentially exploit this vulnerability.

The exploitation path involves making network requests to the LSM service that invoke the dangerous exposed method, causing the service to become unavailable. This impacts all users relying on session management services on the affected Windows system.

Since no verified proof-of-concept code is publicly available, the exploitation mechanism involves targeting the exposed LSM method through network-accessible interfaces. Detailed technical exploitation information can be found in the Microsoft Security Update Guide.

Detection Methods for CVE-2025-26651

Indicators of Compromise

• Unexpected crashes or restarts of the Local Session Manager (lsm.exe) service
• Event log entries indicating LSM service failures or unexpected terminations
• Unusual network traffic patterns targeting LSM-related ports from internal authenticated users
• Multiple failed or disrupted user session events in Windows Event logs

Detection Strategies

• Monitor Windows Event Logs for System events related to LSM service crashes (Event ID 7034, 7031)
• Implement network traffic analysis to detect anomalous RPC/SMB traffic patterns targeting session management services
• Deploy endpoint detection rules to identify unusual LSM service behavior or resource consumption
• Use SentinelOne Singularity Platform to detect and alert on service disruption patterns

Monitoring Recommendations

• Enable detailed logging for Windows services including the Local Session Manager
• Configure alerting for LSM service state changes and unexpected terminations
• Monitor system performance metrics for resource exhaustion patterns associated with session management
• Implement baseline behavior analysis for LSM service network communications

How to Mitigate CVE-2025-26651

Immediate Actions Required

• Apply the Microsoft security update for CVE-2025-26651 immediately on all affected systems
• Review and restrict network access to affected Windows systems where possible
• Audit user accounts with network access to identify potential attack vectors
• Enable enhanced monitoring for LSM service health and session management activity

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should apply the appropriate patches for their Windows versions as documented in the Microsoft Security Update Guide.

The patches address the exposed dangerous method in the LSM component, preventing unauthorized service disruption through network requests. Organizations should prioritize patching based on system criticality and exposure.

Workarounds

• Restrict network access to affected systems using firewall rules to limit exposure
• Implement network segmentation to reduce the attack surface for authenticated users
• Review and apply principle of least privilege for user accounts with network access
• Consider implementing additional authentication requirements for accessing critical systems

# Example: Restrict network access using Windows Firewall
# Block inbound connections to LSM-related services from untrusted networks
netsh advfirewall firewall add rule name="Restrict LSM Access" dir=in action=block protocol=tcp localport=445 remoteip=<untrusted_network_range>

# Monitor LSM service status
sc query lsm