CVE-2025-33056: Windows 10 1507 LSASRV DoS Vulnerability

CVE-2025-33056 Overview

CVE-2025-33056 is an improper access control vulnerability in Microsoft Local Security Authority Server (lsasrv) that allows an unauthorized attacker to deny service over a network. The Local Security Authority Subsystem Service (LSASS) is a critical Windows process responsible for enforcing security policies, handling user authentication, and managing access tokens. This vulnerability enables remote attackers without any privileges to disrupt authentication services across the network.

Critical Impact

Successful exploitation can cause denial of service to the LSASS process, potentially disrupting authentication services and causing system instability across affected Windows systems including domain controllers.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 22H2, 23H2, 24H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, 2025

Discovery Timeline

• June 10, 2025 - CVE-2025-33056 published to NVD
• July 10, 2025 - Last updated in NVD database

Technical Details for CVE-2025-33056

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within the lsasrv.dll component, which is a core library of the Local Security Authority Server. The flaw allows unauthenticated attackers to send specially crafted network requests that bypass normal access validation checks. When exploited, this can cause the LSASS process to become unresponsive or crash, effectively denying authentication services to legitimate users.

The vulnerability can be exploited remotely without user interaction, and no authentication is required to trigger the denial of service condition. This makes it particularly dangerous in enterprise environments where LSASS handles authentication for multiple users and services. Domain controllers running affected Windows Server versions are especially at risk, as an LSASS failure could impact authentication across the entire domain.

Root Cause

The root cause is an improper access control implementation in the lsasrv component that fails to properly validate incoming network requests. The vulnerability exists in how the Local Security Authority Server processes certain authentication-related requests, allowing malformed or malicious input to bypass access control mechanisms and trigger a denial of service condition.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can send specially crafted requests to the LSASS service on a vulnerable Windows system to trigger the denial of service. The attack does not require any privileges on the target system and can be launched from any network position that can reach the target.

The vulnerability affects the availability of the system but does not allow unauthorized access to confidential data or modification of system integrity. The exploitation pattern involves sending malicious requests that cause the LSASS process to fail its access control checks, resulting in service disruption.

Detection Methods for CVE-2025-33056

Indicators of Compromise

• Unexpected LSASS process crashes or high resource consumption
• Windows Event Log entries indicating LSASS service failures (Event ID 1000, 1001 in Application log)
• Repeated authentication failures across multiple users or services
• Unusual network traffic patterns targeting LSASS-related ports (RPC, LDAP, Kerberos)

Detection Strategies

• Monitor Windows Event Logs for LSASS crash events and application errors related to lsasrv.dll
• Implement network intrusion detection rules to identify anomalous traffic patterns targeting authentication services
• Use endpoint detection and response (EDR) solutions to monitor LSASS process behavior and detect abnormal activity
• Enable Windows Defender Credential Guard where supported to add additional protection layers around LSASS

Monitoring Recommendations

• Configure alerting for LSASS process termination events across all Windows systems, especially domain controllers
• Monitor network traffic for unusual RPC or authentication protocol activity from untrusted sources
• Implement security information and event management (SIEM) rules to correlate LSASS-related events across the environment
• Track patch compliance across the organization to ensure all affected systems are remediated

How to Mitigate CVE-2025-33056

Immediate Actions Required

• Apply the latest Microsoft security updates for all affected Windows systems immediately
• Prioritize patching domain controllers and critical authentication infrastructure
• Implement network segmentation to limit exposure of LSASS services to untrusted networks
• Enable Windows Defender Credential Guard on supported systems to provide additional LSASS protection

Patch Information

Microsoft has released security updates to address this vulnerability. Administrators should refer to the Microsoft Security Response Center advisory for detailed patch information and download links for all affected Windows versions. Apply updates through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog based on your organization's patch management process.

Workarounds

• Restrict network access to domain controllers and critical Windows servers from untrusted networks
• Implement firewall rules to limit RPC and authentication protocol traffic to known trusted sources
• Consider enabling Windows Defender Credential Guard to run LSASS in a virtualized container on supported systems
• Monitor LSASS process health and configure automatic service recovery policies

# Enable Windows Firewall rules to restrict RPC access
netsh advfirewall firewall add rule name="Block External RPC" dir=in action=block protocol=tcp localport=135
netsh advfirewall firewall add rule name="Allow Internal RPC" dir=in action=allow protocol=tcp localport=135 remoteip=localsubnet