CVE-2025-53809: Windows 11 24H2 LSASS DOS Vulnerability

CVE-2025-53809 Overview

CVE-2025-53809 is a denial-of-service vulnerability in the Windows Local Security Authority Subsystem Service (LSASS). Improper input validation ([CWE-20]) allows an authenticated attacker to send crafted network traffic that disrupts LSASS availability on affected Windows systems. The flaw impacts Windows 11 24H2 and Windows Server 2025. Because LSASS handles authentication, session management, and security policy enforcement, service disruption can cascade into failed logons and broader operational impact on affected hosts.

Critical Impact
An authorized network attacker can trigger a denial-of-service condition against LSASS, disrupting authentication and identity services on Windows 11 24H2 and Windows Server 2025.

Affected Products

Microsoft Windows 11 24H2
Microsoft Windows Server 2025
Systems running the LSASS service exposed to authenticated network callers

Discovery Timeline

2025-09-09 - CVE-2025-53809 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53809

Vulnerability Analysis

The vulnerability resides in the Local Security Authority Subsystem Service (lsass.exe), a core Windows process responsible for enforcing security policy, handling user logons, and issuing access tokens. LSASS validates incoming requests over authenticated network protocols. Malformed or unexpected input reaches internal parsing routines without adequate validation, producing an unrecoverable error condition. When LSASS becomes unresponsive or terminates, dependent authentication and identity operations fail on the affected host. The issue is classified as improper input validation ([CWE-20]) and requires low-privileged authenticated access rather than administrative rights.

Root Cause

The root cause is missing or insufficient validation of attacker-controlled input processed by LSASS over the network. Input that falls outside expected structural or semantic bounds is not rejected before it reaches sensitive processing paths. The result is a service-availability failure rather than memory corruption, so the vulnerability affects integrity of service uptime rather than confidentiality or data integrity.

Attack Vector

An attacker with valid credentials on the network sends specially crafted requests to a vulnerable Windows 11 24H2 or Windows Server 2025 system. The attack is remotely reachable, requires low complexity, and needs no user interaction. Successful exploitation renders LSASS unavailable, which typically forces a system restart to restore authentication services. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor technical details.

No verified proof-of-concept code is publicly available.
Refer to the Microsoft Security Update Guide for vendor-provided technical details.

Detection Methods for CVE-2025-53809

Indicators of Compromise

Unexpected termination or crash of lsass.exe recorded in the Windows Application event log (Event ID 1000) or Service Control Manager events (Event ID 7031 / 7034).
Sudden spikes of failed authentications, Kerberos and NTLM errors, or client logon timeouts across a domain.
Automatic system restarts triggered by LSASS failure on Windows 11 24H2 or Windows Server 2025 hosts.

Detection Strategies

Monitor process stability of lsass.exe and alert on abnormal termination, restart, or hang states on affected Windows versions.
Correlate authentication failures across multiple endpoints with LSASS service events to identify coordinated denial-of-service attempts.
Inspect authenticated SMB, RPC, and LDAP traffic destined for domain controllers and member servers for anomalous request patterns from a single principal.

Monitoring Recommendations

Forward Windows Security, System, and Application logs to a centralized SIEM and build detections for LSASS crashes and repeated service restarts.
Track authentication baseline metrics per host, and alert when Kerberos or NTLM error rates deviate significantly from normal.
Review network telemetry for authenticated sessions that immediately precede LSASS instability events.

How to Mitigate CVE-2025-53809

Immediate Actions Required

Apply the Microsoft security update for CVE-2025-53809 to all Windows 11 24H2 and Windows Server 2025 systems as identified in the Microsoft Security Update Guide.
Prioritize patching domain controllers and other hosts running LSASS in authentication-critical roles.
Audit accounts with network logon rights and remove unnecessary privileges to reduce the pool of principals who could reach the vulnerable service.

Patch Information

Microsoft addressed CVE-2025-53809 in security updates published through the Microsoft Security Update Guide. Administrators should consult the vendor advisory for the specific KB article and cumulative update matching each affected build of Windows 11 24H2 and Windows Server 2025. Deploy the update through Windows Update, Windows Server Update Services (WSUS), or a managed patching pipeline.

Workarounds

Restrict network access to LSASS-exposed services (SMB, RPC, LDAP) using host-based firewalls and network segmentation where patching is delayed.
Enforce strict authentication controls and require multi-factor authentication for accounts able to reach affected servers over the network.
Monitor for LSASS crashes and configure alerting so that operations teams can respond quickly to service disruption pending full patch deployment.

bash

# Example: restrict inbound SMB to trusted management subnet on Windows Server 2025
New-NetFirewallRule -DisplayName "Restrict SMB to Mgmt" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.10.0.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block SMB from Others" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -Action Block