CVE-2025-59257: Windows 11 24H2 LSM DOS Vulnerability

CVE-2025-59257 Overview

CVE-2025-59257 is a denial of service vulnerability in the Windows Local Session Manager (LSM). The flaw stems from improper validation of specified input types, categorized as [CWE-1287]. An authenticated attacker can exploit the weakness over a network to disrupt service availability on affected Windows systems.

Microsoft published the advisory on October 14, 2025. The vulnerability affects current Windows 11 releases and recent Windows Server versions. No public exploit code or in-the-wild exploitation has been reported, and CISA has not added the issue to the Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated remote attacker can trigger a denial of service condition against the Local Session Manager, potentially disrupting interactive sessions and dependent services on affected Windows hosts.

Affected Products

Microsoft Windows 11 24H2
Microsoft Windows 11 25H2
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-10-14 - CVE-2025-59257 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59257

Vulnerability Analysis

The Local Session Manager (LSM) is a Windows subsystem that manages user sessions on the local machine. It coordinates session creation, connection, and teardown for both local console users and remote connections through services such as Remote Desktop.

The vulnerability arises from improper validation of a specified input type reaching the LSM component. When the service processes a crafted request, the type mismatch produces an unhandled condition that halts availability of the service. Because LSM is central to session handling, disruption can cascade into loss of interactive logon and session brokering functionality.

Exploitation requires network access and valid authenticated credentials on the target. No user interaction is needed, and the attack complexity is low. The impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The root cause is improper validation of input data types within a code path processed by the Local Session Manager. Under [CWE-1287], the component accepts input without verifying that the value conforms to the expected data type, leading the service into an unrecoverable state when unexpected input is supplied.

Attack Vector

An authenticated attacker with low privileges sends a specially crafted request across the network to the LSM service. Processing the malformed input causes the service to enter a denial of service state, disrupting session management on the target host. No public proof-of-concept has been released.

See the Microsoft Security Update Guide CVE-2025-59257 for vendor technical details.

Detection Methods for CVE-2025-59257

Indicators of Compromise

Unexpected crashes, restarts, or hangs of the Local Session Manager service on affected Windows hosts.
Windows Event Log entries showing session manager or session broker failures without clean administrative cause.
Sudden loss of Remote Desktop or interactive session availability tied to a specific low-privilege authenticated source.

Detection Strategies

Correlate authenticated network logons with subsequent LSM service instability originating from the same source account or host.
Monitor for repeated malformed or anomalous session-management RPC traffic to affected servers.
Baseline normal session broker behavior and alert on deviations such as repeated service faults within short windows.

Monitoring Recommendations

Forward Windows System and Application event logs to a centralized log platform for correlation and long-term retention.
Track authentication events preceding service crashes to identify the initiating principal.
Alert on abnormal termination or restart patterns of session management processes on Windows 11 24H2, 25H2, Server 2022 23H2, and Server 2025 hosts.

How to Mitigate CVE-2025-59257

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2025-59257 to all affected Windows 11 and Windows Server systems.
Inventory Windows 11 24H2, 25H2, Windows Server 2022 23H2, and Windows Server 2025 hosts and prioritize patching for internet-exposed or multi-tenant systems.
Enforce least privilege on interactive and remote logon rights to reduce the pool of accounts able to reach the vulnerable code path.

Patch Information

Microsoft released a fix as part of its October 2025 security update cycle. Refer to the Microsoft Security Update Guide CVE-2025-59257 for the exact update package that corresponds to each affected Windows build.

Workarounds

Restrict network access to session management services using host-based firewalls and network segmentation, limiting exposure to trusted management subnets.
Require multi-factor authentication and strong credential hygiene to reduce the likelihood of authenticated attackers reaching the vulnerable service.
Monitor and rate-limit authenticated RPC traffic from user endpoints to Windows Server session hosts where feasible.

bash

# Configuration example: restrict inbound RDP/session management to a management subnet
New-NetFirewallRule -DisplayName "Restrict-LSM-RDP-Inbound" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 3389 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow