CVE-2025-58729 Overview
CVE-2025-58729 is a denial-of-service vulnerability in the Windows Local Session Manager (LSM) service. The flaw stems from improper validation of a specified input type [CWE-1287], allowing an authorized attacker with network access to disrupt the service. Successful exploitation results in a high availability impact on the target host, though confidentiality and integrity remain unaffected. Microsoft addressed the issue as part of its coordinated security update process. The vulnerability affects a broad range of currently supported Windows client and server versions, including Windows 11 25H2 and Windows Server 2025.
Critical Impact
An authenticated remote attacker can trigger a denial-of-service condition in the Windows Local Session Manager, disrupting session management and user access on affected hosts.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2, 25H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-10-14 - CVE-2025-58729 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58729
Vulnerability Analysis
The Local Session Manager (lsm.exe) is a core Windows service responsible for managing user sessions on a system, including session creation, connection, and disconnection. It coordinates closely with the Remote Desktop Services stack and the Windows subsystem for interactive logons. CVE-2025-58729 arises from improper validation of a specific input type received by the service. An authorized attacker sending crafted input over the network can cause the service to enter an error state and stop processing session requests.
The issue is categorized under CWE-1287: Improper Validation of Specified Type of Input. Because LSM handles session state, disruption of the service impairs interactive logon and remote session functionality on the affected host. The attack requires low privileges and no user interaction, and it targets availability only.
Root Cause
The root cause is the failure of the Local Session Manager to correctly validate the type or structure of input it receives before processing. Malformed or unexpected input values are consumed without adequate type checks, leading to an unhandled condition that terminates or hangs the service.
Attack Vector
Exploitation requires network reachability to a service exposed by LSM and valid credentials on the target host. An attacker holding a low-privileged authenticated foothold on a Windows network can send crafted requests to trigger the fault. There are no public proof-of-concept exploits, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploit code is publicly available. See the Microsoft Security Update Guide for CVE-2025-58729 for authoritative technical guidance.
Detection Methods for CVE-2025-58729
Indicators of Compromise
- Unexpected termination or crash events for the lsm.exe process or the Local Session Manager service in the Windows Service Control Manager event log (Event ID 7031, 7034).
- Sudden loss of interactive logon or Remote Desktop session functionality without a preceding administrative action.
- Repeated malformed network requests from a low-privileged internal account directed at RDP-related session services.
Detection Strategies
- Monitor Windows System event logs for repeated Service Control Manager entries indicating LSM restarts or failures.
- Correlate authenticated network sessions from non-administrator accounts with subsequent LSM service failures on the same host.
- Baseline normal session-management RPC traffic and alert on anomalous request patterns from internal endpoints.
Monitoring Recommendations
- Ingest Windows System, Security, and Remote Desktop Services operational logs into a centralized SIEM for cross-host correlation.
- Track authentication events (Event IDs 4624, 4625) preceding LSM crashes to identify the originating account.
- Alert on hosts experiencing repeated denial-of-service symptoms on session-management services within short time windows.
How to Mitigate CVE-2025-58729
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2025-58729 to all affected Windows client and server versions.
- Restrict network exposure of Remote Desktop and session-management services to trusted management networks only.
- Enforce least privilege for domain and local accounts to reduce the pool of users who satisfy the authentication precondition.
Patch Information
Microsoft has released fixes through its regular update channels. Refer to the Microsoft Security Update Guide entry for CVE-2025-58729 for the specific KB articles that apply to each Windows version, and deploy them through Windows Update, WSUS, or your enterprise patch-management tooling.
Workarounds
- Limit inbound access to Remote Desktop (TCP 3389) and related session services using host-based and network firewalls where patching is not immediately feasible.
- Require Network Level Authentication (NLA) for RDP to reduce pre-authentication attack surface against session services.
- Disable RDP on hosts that do not require remote interactive access until updates are applied.
# Example: restrict RDP access to a management subnet on Windows using PowerShell
New-NetFirewallRule -DisplayName "Restrict RDP to Mgmt Subnet" `
-Direction Inbound -Protocol TCP -LocalPort 3389 `
-RemoteAddress 10.10.50.0/24 -Action Allow
# Block RDP from all other sources
New-NetFirewallRule -DisplayName "Block RDP from Other Sources" `
-Direction Inbound -Protocol TCP -LocalPort 3389 `
-Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
