CVE-2025-32724: Windows 10 1507 LSASS DoS Vulnerability

CVE-2025-32724 Overview

CVE-2025-32724 is a denial of service vulnerability affecting the Windows Local Security Authority Subsystem Service (LSASS), a critical Windows component responsible for authentication, security policy enforcement, and credential management. This vulnerability allows an unauthorized attacker to cause uncontrolled resource consumption in LSASS over a network, potentially rendering the affected system unresponsive.

LSASS is an essential Windows process that handles user authentication for logons, password changes, and access token generation. Due to improper resource management (CWE-400), remote attackers can exploit this vulnerability without requiring any privileges or user interaction, making it particularly dangerous for exposed systems.

Critical Impact

Successful exploitation can cause LSASS to consume excessive system resources, leading to denial of service conditions that may require a system restart. Given LSASS's critical role in authentication, this could effectively lock users out of affected systems and disrupt enterprise authentication services.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
• Microsoft Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025

Discovery Timeline

• 2025-06-10 - CVE-2025-32724 published to NVD
• 2025-07-10 - Last updated in NVD database

Technical Details for CVE-2025-32724

Vulnerability Analysis

This vulnerability stems from uncontrolled resource consumption (CWE-400) within the Windows Local Security Authority Subsystem Service. LSASS processes various authentication requests and security operations, and the flaw allows remote attackers to trigger excessive resource usage without proper throttling or limits.

The attack can be initiated remotely over a network without requiring authentication or user interaction. This makes it particularly concerning for domain controllers and systems with LSASS services exposed to untrusted networks. An attacker exploiting this vulnerability could cause the LSASS process to consume CPU cycles, memory, or other system resources to the point where the system becomes unresponsive.

Given that LSASS is protected by Windows security mechanisms and cannot simply be terminated without causing a system reboot, successful exploitation effectively forces administrators to restart affected machines to restore functionality.

Root Cause

The vulnerability exists due to improper handling of resource allocation within LSASS when processing certain network requests. The service fails to implement adequate controls to prevent or limit resource consumption when handling malformed or excessive requests, allowing attackers to exhaust system resources.

This type of flaw typically occurs when input validation or rate limiting is insufficient, enabling specially crafted requests to trigger resource-intensive operations without appropriate bounds checking.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to a vulnerable system can send specially crafted requests to trigger the resource exhaustion condition.

The exploitation mechanism involves sending requests that cause LSASS to perform resource-intensive operations. Since no privilege escalation is required and the attack can be executed remotely, organizations with exposed Windows systems are at significant risk. The vulnerability specifically impacts availability, with no effect on confidentiality or integrity of data.

Due to the nature of this vulnerability, detailed exploitation techniques are not provided to prevent malicious use. Organizations should refer to the Microsoft Security Update Guide for technical details.

Detection Methods for CVE-2025-32724

Indicators of Compromise

• Unusual CPU or memory consumption by the lsass.exe process
• LSASS process becoming unresponsive or timing out during authentication requests
• Abnormal network traffic patterns targeting LSASS-related ports (e.g., TCP 445, 389, 636)
• System event logs showing LSASS-related errors or resource exhaustion warnings

Detection Strategies

• Monitor lsass.exe process resource utilization using Windows Performance Monitor or endpoint detection solutions
• Implement network traffic analysis to detect anomalous connection patterns to authentication services
• Configure Windows Event Log alerting for LSASS-related warnings and errors (Event IDs related to authentication failures and resource constraints)
• Deploy behavioral analysis rules to detect denial of service attack patterns against critical Windows services

Monitoring Recommendations

• Establish baseline metrics for normal LSASS resource consumption and alert on significant deviations
• Implement network segmentation to limit exposure of LSASS services to untrusted networks
• Enable advanced audit logging for authentication events to correlate potential attack activity
• Use SentinelOne's behavioral AI engine to detect anomalous process behavior indicative of resource exhaustion attacks

How to Mitigate CVE-2025-32724

Immediate Actions Required

• Apply the latest Microsoft security updates immediately to all affected Windows systems
• Restrict network access to LSASS-related services from untrusted networks using firewall rules
• Prioritize patching domain controllers and critical authentication servers
• Review and harden network segmentation to protect Windows authentication infrastructure

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should apply the appropriate cumulative updates for their Windows versions. Detailed patch information and download links are available in the Microsoft Security Update Guide for CVE-2025-32724.

Organizations should prioritize patching based on system criticality, with domain controllers and externally accessible systems receiving immediate attention.

Workarounds

• Implement network-level controls to restrict access to Windows authentication services from untrusted sources
• Configure Windows Firewall to limit inbound connections to LSASS-dependent services
• Enable rate limiting at the network perimeter for authentication-related traffic
• Consider implementing network monitoring solutions to detect and block potential exploitation attempts

# Example: Block external access to common LSASS-related ports using Windows Firewall
netsh advfirewall firewall add rule name="Block External LDAP" dir=in action=block protocol=tcp localport=389 remoteip=any
netsh advfirewall firewall add rule name="Block External LDAPS" dir=in action=block protocol=tcp localport=636 remoteip=any
# Note: Adjust rules based on your network architecture - ensure legitimate traffic is allowed