CVE-2025-53716 Overview
CVE-2025-53716 is a null pointer dereference vulnerability in the Windows Local Security Authority Subsystem Service (LSASS). An authenticated attacker can send crafted requests over the network to trigger a null pointer dereference in lsass.exe, causing the service to crash. When LSASS terminates, Windows initiates a system restart, resulting in a denial of service condition. The flaw is tracked under CWE-476: NULL Pointer Dereference and affects a broad range of Windows client and server releases. Microsoft published the advisory on August 12, 2025.
Critical Impact
An authenticated remote attacker can crash LSASS on affected Windows systems, forcing a reboot and disrupting authentication services domain-wide.
Affected Products
- Microsoft Windows 10 (1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-08-12 - CVE-2025-53716 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53716
Vulnerability Analysis
The vulnerability resides in the Local Security Authority Subsystem Service, the Windows process responsible for enforcing security policy, handling authentication, and issuing access tokens. LSASS processes network authentication traffic from protocols such as NTLM, Kerberos, and Netlogon. A specific code path in LSASS fails to validate a pointer before dereferencing it, allowing a malformed authenticated request to cause an access violation.
When lsass.exe crashes, the Windows kernel treats the failure as a critical process termination and initiates an automatic reboot. On domain controllers, this disrupts authentication for every client in the domain until the system restores service.
Root Cause
The root cause is missing pointer validation inside an LSASS request handler [CWE-476]. A code path processing attacker-controlled input dereferences a pointer that can be null under specific conditions. Microsoft has not publicly disclosed the exact component or protocol handler containing the flaw.
Attack Vector
Exploitation requires network access and valid credentials on the target system. The attacker sends a crafted authentication or RPC request to a remote Windows host. No user interaction is required. Because LSASS listens for authentication traffic on standard Windows ports, any authenticated user with network reachability to the target can trigger the condition. Public proof-of-concept code is not currently available. See the Microsoft Security Update Guide entry for CVE-2025-53716 for vendor technical details.
Detection Methods for CVE-2025-53716
Indicators of Compromise
- Unexpected termination of lsass.exe recorded in the System event log, followed by an automatic reboot (Event ID 1074 with a critical process death reason).
- Windows Error Reporting entries referencing lsass.exe faults with access violation exception codes (0xC0000005).
- Bugcheck CRITICAL_PROCESS_DIED (stop code 0x000000EF) in memory dumps naming LSASS as the failing process.
Detection Strategies
- Monitor for repeated LSASS crashes across multiple hosts within a short window, which suggests active exploitation rather than an isolated fault.
- Correlate authentication protocol traffic (SMB, RPC, Kerberos, Netlogon) from a single source with LSASS termination events on the target.
- Alert on unplanned domain controller reboots and cross-reference against change management records.
Monitoring Recommendations
- Ingest Windows System, Security, and Application logs plus WER crash telemetry into a centralized SIEM for correlation.
- Baseline normal LSASS uptime per host and alert on deviations, particularly on domain controllers and identity infrastructure.
- Track authenticated RPC and SMB session sources targeting sensitive servers to identify anomalous callers.
How to Mitigate CVE-2025-53716
Immediate Actions Required
- Apply the Microsoft security update for CVE-2025-53716 to all affected Windows 10, Windows 11, and Windows Server systems, prioritizing domain controllers.
- Restrict inbound access to authentication services (SMB, RPC, LDAP, Kerberos) from untrusted network segments using host firewalls and network segmentation.
- Audit and reduce the number of accounts with network logon rights to critical servers to limit the pool of potential attackers.
Patch Information
Microsoft released fixes as part of the August 2025 security update cycle. Refer to the Microsoft Security Update Guide for CVE-2025-53716 for KB article numbers specific to each supported Windows build and installation instructions.
Workarounds
- No official vendor workaround exists; patching is the required remediation.
- Enforce network-level authentication controls and firewall rules that limit which hosts can reach LSASS-exposed services on servers.
- Ensure automatic reboot recovery and monitoring are configured so unplanned LSASS failures are surfaced quickly to responders.
# Verify installed Windows security updates on affected hosts
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Restrict inbound SMB/RPC to trusted management subnets (example)
New-NetFirewallRule -DisplayName "Restrict LSASS-facing RPC" -Direction Inbound `
-Protocol TCP -LocalPort 135,445 -RemoteAddress 10.0.0.0/24 -Action Allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
