CVE-2025-29957: Windows 10 1507 DOS Vulnerability

CVE-2025-29957 Overview

CVE-2025-29957 is a denial-of-service vulnerability in Windows Deployment Services (WDS). The flaw stems from uncontrolled resource consumption [CWE-400, CWE-770] in the WDS component shipped with supported Windows client and server releases. A local, unauthenticated attacker can trigger the condition to exhaust host resources and render the service unavailable. Microsoft addressed the issue in the May 2025 security update cycle.

Critical Impact
Successful exploitation causes a local denial of service against Windows Deployment Services, disrupting operating system provisioning workflows that depend on WDS for network-based installations.

Affected Products

Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-05-13 - CVE-2025-29957 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29957

Vulnerability Analysis

Windows Deployment Services provides PXE boot and image deployment functions used to install Windows across networked machines. CVE-2025-29957 arises when the service fails to bound the allocation or processing of specific inputs, allowing an attacker to force excessive consumption of memory, CPU, or handle resources. The condition maps to [CWE-400] Uncontrolled Resource Consumption and [CWE-770] Allocation of Resources Without Limits or Throttling.

Exploitation does not disclose information or modify data. It halts the WDS service and any deployment jobs relying on it. Environments using WDS as part of imaging pipelines lose the ability to provision new endpoints until the service recovers.

Root Cause

The vulnerable code path processes attacker-influenced input without enforcing rate limits or allocation ceilings. Repeated or malformed requests drive resource use until the service, or the host process, becomes unresponsive.

Attack Vector

The attack vector is local. An attacker executes code on the host running WDS to trigger the resource exhaustion. No authentication or user interaction is required. The impact is limited to availability of the WDS service on the affected host.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Microsoft has not reported exploitation in the wild. Refer to the Microsoft CVE-2025-29957 Advisory for authoritative technical details.

Detection Methods for CVE-2025-29957

Indicators of Compromise

Unexpected termination or repeated restarts of the WDSServer service on hosts with the WDS role installed.
Abnormal memory or handle growth in the wdsserver.exe process without a corresponding legitimate imaging workload.
PXE clients reporting deployment failures or timeouts against a previously healthy WDS server.

Detection Strategies

Monitor Windows Event Logs for Service Control Manager entries showing crashes or hangs of the WDS service.
Correlate local process creation events on WDS hosts with sudden spikes in resource utilization tied to wdsserver.exe.
Alert on unauthorized local logons or scheduled task creation on servers hosting the WDS role.

Monitoring Recommendations

Track availability metrics for WDS and PXE responses to detect denial-of-service conditions quickly.
Baseline normal resource utilization of wdsserver.exe and alert on sustained deviations.
Forward WDS-related event channels and performance counters to a centralized logging platform for correlation.

How to Mitigate CVE-2025-29957

Immediate Actions Required

Apply the May 2025 Microsoft security updates that address CVE-2025-29957 across all affected Windows client and Server SKUs.
Inventory servers with the Windows Deployment Services role and prioritize patching those exposed to shared or multi-tenant networks.
Restrict local logon rights on WDS servers to a minimal set of administrative accounts.

Patch Information

Microsoft published fixes as part of the May 2025 Patch Tuesday release. Consult the Microsoft CVE-2025-29957 Advisory for the specific KB articles that apply to each affected Windows version, and deploy through Windows Update, WSUS, or your standard patch management workflow.

Workarounds

Disable the Windows Deployment Services role on hosts where it is not actively used for imaging.
Isolate WDS servers on dedicated management VLANs and block interactive local access from general-purpose accounts.
Increase monitoring and enforce resource quotas at the host level to limit the blast radius of a service disruption until patches are applied.

bash

# Example: disable the WDS Server service on a host where the role is not required
sc.exe config WDSServer start= disabled
sc.exe stop WDSServer