CVE-2025-29971: Windows 11 22H2 DoS Vulnerability

CVE-2025-29971 Overview

CVE-2025-29971 is an out-of-bounds read vulnerability in the Microsoft Web Threat Defense driver (WTD.sys) shipped with Windows 11. An unauthenticated remote attacker can trigger the flaw over a network to cause a denial-of-service condition on affected systems. The vulnerability maps to [CWE-125: Out-of-bounds Read] and affects multiple Windows 11 builds across both x64 and ARM64 architectures. Microsoft published the advisory on May 13, 2025, and the issue carries an EPSS probability of 9.753%, placing it in the 93rd percentile for likelihood of exploitation activity. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.

Critical Impact
A remote, unauthenticated attacker can crash or destabilize the Web Threat Defense kernel driver, disrupting availability of Windows 11 endpoints over the network.

Affected Products

Microsoft Windows 11 22H2 (x64, ARM64)
Microsoft Windows 11 23H2 (x64, ARM64)
Microsoft Windows 11 24H2 (x64, ARM64)

Discovery Timeline

2025-05-13 - CVE-2025-29971 published to NVD with Microsoft advisory
2025-05-19 - Last updated in NVD database

Technical Details for CVE-2025-29971

Vulnerability Analysis

The flaw resides in WTD.sys, the kernel-mode driver implementing Microsoft Web Threat Defense functionality on Windows 11. The driver performs read operations on network-sourced data without correctly validating buffer boundaries. When the driver processes a malformed input, it reads past the end of an allocated structure, dereferencing memory outside the intended range. Because the faulty code path runs in kernel context, an invalid read triggers a bug check and forces the operating system into a crash and reboot cycle. The vulnerability impacts availability only — it does not expose data confidentiality or allow integrity tampering on the target host.

Root Cause

The root cause is improper bounds checking [CWE-125] within a parsing routine inside WTD.sys. The driver trusts a length or offset field from attacker-influenced data and uses it to index into a buffer without confirming the value falls within the allocated region. The resulting out-of-bounds read accesses unmapped or guarded kernel memory, producing a fatal access violation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted traffic that reaches the Web Threat Defense processing path on a vulnerable Windows 11 host. Successful exploitation results in a kernel-level denial of service, taking the target offline until it restarts. Public exploit code is not available, and Microsoft has not reported in-the-wild exploitation.

No verified proof-of-concept code is available. Refer to the Microsoft Security Update Guide for CVE-2025-29971 for vendor technical details.

Detection Methods for CVE-2025-29971

Indicators of Compromise

Unexpected bug checks or system crashes referencing WTD.sys in Windows memory dumps or WER reports.
Repeated unplanned reboots of Windows 11 endpoints correlated with inbound network activity from a single source.
Event ID 1001 (BugCheck) entries in the System event log following external network connections.

Detection Strategies

Correlate kernel crash telemetry from Windows 11 hosts with network flow data to identify attacker-controlled sources triggering WTD.sys faults.
Monitor EDR telemetry for kernel module faults attributed to WTD.sys across multiple endpoints in a short time window, which can indicate active probing.
Hunt for repeated short-lived TCP/UDP sessions to Windows 11 hosts followed immediately by host unavailability.

Monitoring Recommendations

Forward Windows BugCheck (Event ID 1001) and kernel-mode crash dumps to a centralized SIEM for correlation.
Track patch deployment state for the May 2025 Microsoft security rollup across all Windows 11 22H2, 23H2, and 24H2 endpoints.
Baseline normal WTD.sys behavior and alert on abnormal driver fault rates.

How to Mitigate CVE-2025-29971

Immediate Actions Required

Apply the May 2025 Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2025-29971 to all Windows 11 22H2, 23H2, and 24H2 systems.
Prioritize patching internet-facing and high-availability Windows 11 hosts, since the attack vector is network-based and unauthenticated.
Verify patch installation by confirming the updated build numbers across the fleet using configuration management tooling.

Patch Information

Microsoft released a security update addressing CVE-2025-29971 on May 13, 2025. The fix is delivered through the standard Windows Update channel and Windows Server Update Services (WSUS). Administrators should consult the Microsoft Security Update Guide for CVE-2025-29971 for the specific KB article and build numbers corresponding to each Windows 11 release.

Workarounds

Restrict inbound network access to Windows 11 endpoints using host-based firewall rules where Web Threat Defense traffic is not required.
Segment Windows 11 clients from untrusted networks until the security update is applied across the environment.
Increase monitoring of kernel crash telemetry on unpatched hosts to detect exploitation attempts early.

bash

# Verify Windows 11 build and patch status via PowerShell
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10