CVE-2025-29956: Windows 10 1507 SMB Information Disclosure

CVE-2025-29956 Overview

CVE-2025-29956 is a buffer over-read vulnerability in the Windows Server Message Block (SMB) implementation. An authorized attacker can trigger the flaw over a network to read memory beyond an allocated buffer, resulting in information disclosure. The issue affects a broad range of Microsoft Windows client and server releases, from legacy Windows Server 2008 through Windows Server 2025 and Windows 11 24H2.

Microsoft published the advisory on May 13, 2025. The vulnerability is classified under CWE-126: Buffer Over-read and CWE-125: Out-of-bounds Read.

Critical Impact
An authenticated network attacker can read adjacent kernel or process memory through malformed SMB traffic, potentially exposing sensitive data such as credentials, session tokens, or memory pointers useful for chaining further attacks.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-05-13 - Microsoft releases security update addressing CVE-2025-29956
2025-05-13 - CVE-2025-29956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29956

Vulnerability Analysis

The vulnerability resides in the Windows SMB protocol stack. SMB is the file, printer, and inter-process communication protocol used across Windows environments. The flaw allows an authenticated remote attacker to cause the SMB service to read data beyond the intended buffer boundary.

The over-read leaks the contents of adjacent memory back to the attacker within an SMB response or error path. Because SMB runs with elevated privileges, disclosed memory can include cached credentials, session artifacts, or protocol state useful for follow-on attacks.

Exploitation requires a valid account on the target and depends on user interaction, which increases attack complexity. The impact is limited to confidentiality and minor availability effects; integrity is not affected.

Root Cause

The root cause is improper validation of buffer length fields during SMB message parsing. The affected code path reads past the end of an allocated buffer, returning uninitialized or adjacent memory to the caller. This behavior aligns with CWE-126 (Buffer Over-read) and CWE-125 (Out-of-bounds Read).

Attack Vector

The attack originates over the network against SMB services (typically TCP port 445). The attacker must be authenticated with low privileges and must induce a user interaction on the target to complete exploitation. A crafted SMB request or response with malformed length fields drives the vulnerable parser into the over-read state, and the attacker collects the leaked memory from the resulting SMB traffic.

No public proof-of-concept code has been released for CVE-2025-29956, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor technical detail.

Detection Methods for CVE-2025-29956

Indicators of Compromise

Unexpected SMB session activity from low-privileged accounts targeting file servers or domain controllers on TCP port 445.
SMB error responses of anomalous length or containing non-textual binary payloads that suggest leaked memory contents.
Repeated malformed SMB2/SMB3 requests from a single client, particularly with unusual length or offset fields.

Detection Strategies

Enable SMB Server auditing (Event IDs 3000-series in the Microsoft-Windows-SMBServer/Audit and Operational channels) to record protocol-level anomalies.
Deploy network detection signatures for malformed SMB2/SMB3 headers and out-of-range length fields on port 445.
Correlate authentication events (Event ID 4624 with logon type 3) with subsequent SMB errors to identify low-privileged accounts triggering parser faults.

Monitoring Recommendations

Baseline normal SMB client behavior per account and alert on deviations such as bursts of non-standard SMB commands.
Monitor egress patterns from file servers for unusual data returned to specific clients following malformed SMB requests.
Track patch state of Windows systems exposing SMB and prioritize remediation on internet-adjacent or multi-tenant hosts.

How to Mitigate CVE-2025-29956

Immediate Actions Required

Apply the May 13, 2025 Microsoft security updates that address CVE-2025-29956 to all affected Windows client and server versions.
Restrict inbound SMB (TCP 445) at the network perimeter and between segments where SMB access is not required.
Audit accounts with SMB access rights and remove or downgrade unused low-privileged accounts that could be leveraged for exploitation.

Patch Information

Microsoft has released cumulative updates addressing CVE-2025-29956 across supported Windows versions. Refer to the Microsoft Security Update Guide entry for CVE-2025-29956 for the KB article that matches each affected build. Legacy platforms such as Windows Server 2008 and 2012 require updates delivered through the Extended Security Update (ESU) program.

Workarounds

Disable SMBv1 where still enabled and enforce SMB signing and encryption to reduce exposure of protocol data.
Block TCP port 445 at host firewalls on systems that do not need to serve SMB, using Windows Defender Firewall inbound rules.
Constrain SMB access with authenticated network segmentation, VPN gateways, or Just-Enough-Access controls until patches are deployed.

bash

# Example: block inbound SMB on Windows hosts that do not serve files
New-NetFirewallRule -DisplayName "Block Inbound SMB 445" \
  -Direction Inbound -Protocol TCP -LocalPort 445 -Action Block

# Verify SMBv1 is disabled
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

# Enforce SMB signing on the server
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force