CVE-2025-30394: Windows Server 2012 DoS Vulnerability

CVE-2025-30394 Overview

CVE-2025-30394 is a denial of service vulnerability in the Microsoft Remote Desktop Gateway (RD Gateway) Service. The flaw stems from sensitive data stored in improperly locked memory, combined with a concurrent execution race condition. An unauthenticated remote attacker can trigger the condition over the network to disrupt RD Gateway availability. The vulnerability is tracked under CWE-591 (Sensitive Data Storage in Improperly Locked Memory) and CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). Microsoft addressed the issue in the May 2025 Patch Tuesday cycle across supported Windows Server releases.

Critical Impact
Successful exploitation denies remote desktop access for all users relying on the affected RD Gateway, disrupting remote work and administrative access to internal systems.

Affected Products

Microsoft Windows Server 2012 and 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-05-13 - CVE-2025-30394 published to NVD
2025-05-13 - Microsoft releases security patch via the Microsoft CVE-2025-30394 Advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30394

Vulnerability Analysis

The Remote Desktop Gateway Service tunnels Remote Desktop Protocol (RDP) traffic over HTTPS, allowing external clients to reach internal RDP hosts. The vulnerability arises when the service handles sensitive data in memory regions that are not properly locked against concurrent access. Multiple threads can access the same shared resource without adequate synchronization, producing a race condition that corrupts service state.

An attacker exploits the flaw by sending crafted network requests that induce the race. When the race triggers, the RD Gateway process enters an unrecoverable state and stops servicing legitimate connections. The impact is limited to availability, with no confidentiality or integrity loss reported. Attack complexity is high because the attacker must reliably win the timing window, but no authentication or user interaction is required.

The EPSS model places CVE-2025-30394 in the top tier of vulnerabilities for exploitation likelihood, reflecting the exposed nature of RD Gateway on internet-facing perimeters.

Root Cause

The root cause is the combination of [CWE-591] and [CWE-362]. Sensitive process data is placed in memory pages that are not locked, and concurrent threads modify shared state without correct synchronization primitives. The result is a deterministic path to service crash when specific request patterns arrive in parallel.

Attack Vector

Exploitation occurs over the network against the RD Gateway listener, typically TCP 443. The attacker sends crafted concurrent requests that force the vulnerable code path. No credentials, tokens, or client certificates are required. Because RD Gateway is often exposed to the internet to support remote workers, the attack surface extends beyond the internal network.

No public proof-of-concept exploit code is available for CVE-2025-30394. See the Microsoft security update guide for authoritative technical details.

Detection Methods for CVE-2025-30394

Indicators of Compromise

Unexpected termination or repeated restarts of the TSGateway service in the Windows Service Control Manager event log.
Application or System event log entries showing access violations in rpcrt4.dll or RD Gateway components (aaedge.dll, rdgwapi.dll).
Sudden drop in active RD Gateway sessions correlated with a spike in inbound TCP 443 connections from a small set of source addresses.

Detection Strategies

Monitor Windows event IDs 7031, 7034, and 1000 associated with the Remote Desktop Gateway service for repeated crashes within short time windows.
Alert on anomalous connection volume or malformed HTTPS/RPC-over-HTTP requests reaching the RD Gateway listener from untrusted networks.
Correlate service crash events with network telemetry to identify the originating source addresses for blocking and forensic follow-up.

Monitoring Recommendations

Enable detailed logging on RD Gateway via the Network Policy Server (NPS) and forward the Microsoft-Windows-TerminalServices-Gateway/Operational channel to a central SIEM.
Baseline normal RD Gateway connection rates and set thresholds for connection surges and repeated authentication churn.
Track patch state of all internet-facing RD Gateway hosts using inventory tooling and flag unpatched servers for immediate remediation.

How to Mitigate CVE-2025-30394

Immediate Actions Required

Apply the May 2025 Microsoft security updates that address CVE-2025-30394 to every affected Windows Server host running the RD Gateway role.
Inventory all RD Gateway instances exposed to the internet and prioritize them ahead of internal-only deployments.
Restart the TSGateway service after patching and confirm that the updated binaries are loaded.

Patch Information

Microsoft published fixes for Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025 on 2025-05-13. Consult the Microsoft CVE-2025-30394 Advisory for the specific KB numbers matching each server build. Install the updates through Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management platform.

Workarounds

Restrict RD Gateway exposure by placing the service behind a VPN or Zero Trust Network Access broker until patches are deployed.
Enforce source IP allowlists on the perimeter firewall for TCP 443 traffic destined to RD Gateway hosts.
Configure Connection Authorization Policies (CAPs) and Resource Authorization Policies (RAPs) to reduce the pool of clients able to reach vulnerable code paths.

bash

# Example: verify RD Gateway service state and restart after patching
Get-Service -Name TSGateway
Restart-Service -Name TSGateway -Force

# Confirm installed updates on the RD Gateway host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10