CVE-2025-59502: Windows 10 1809 DOS Vulnerability

CVE-2025-59502 Overview

CVE-2025-59502 is a denial of service vulnerability affecting the Windows Remote Procedure Call (RPC) service across multiple versions of Microsoft Windows operating systems. The vulnerability stems from uncontrolled resource consumption (CWE-400), which allows an unauthorized attacker to cause a denial of service condition over a network without requiring authentication or user interaction.

The Windows RPC service is a critical component that enables inter-process communication and is fundamental to many Windows services and applications. A successful exploit of this vulnerability could render affected systems unresponsive, disrupting business operations and potentially cascading to dependent services.

Critical Impact

Unauthenticated attackers can remotely exhaust system resources via the Windows RPC service, causing denial of service across enterprise Windows environments including domain controllers and critical servers.

Affected Products

• Microsoft Windows 10 1809
• Microsoft Windows 10 21H2
• Microsoft Windows 10 22H2
• Microsoft Windows 11 22H2
• Microsoft Windows 11 23H2
• Microsoft Windows 11 24H2
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2
• Microsoft Windows Server 2025

Discovery Timeline

• October 14, 2025 - CVE-2025-59502 published to NVD
• October 22, 2025 - Last updated in NVD database

Technical Details for CVE-2025-59502

Vulnerability Analysis

This vulnerability exists within the Windows Remote Procedure Call (RPC) service, which handles communication between processes both locally and across networked systems. The root issue is classified as CWE-400 (Uncontrolled Resource Consumption), indicating that the RPC service fails to properly limit or manage resource allocation when processing incoming requests.

An attacker exploiting this vulnerability can cause the RPC service to consume excessive system resources—such as memory, CPU cycles, or handle allocations—without proper bounds checking. Because the attack can be executed without authentication and requires no user interaction, it presents a significant risk to exposed systems.

The network-based attack vector means that any Windows system with RPC services accessible over the network could be targeted. This is particularly concerning for Windows Server deployments where RPC is essential for Active Directory, file sharing, print services, and numerous other critical functions.

Root Cause

The vulnerability originates from insufficient resource management within the Windows RPC service implementation. The service fails to adequately throttle or limit resource consumption when handling specially crafted or malformed RPC requests. This allows attackers to send requests that trigger unbounded resource allocation, eventually exhausting available system resources and causing service disruption.

The lack of proper rate limiting or resource quotas in the affected code path enables attackers to amplify the impact of their requests, making even moderate traffic volumes capable of causing complete service denial.

Attack Vector

The attack is network-based and can be executed remotely without requiring any authentication credentials or user interaction. An attacker would need network access to RPC endpoints on the target system, typically exposed on TCP port 135 (RPC Endpoint Mapper) and dynamic high ports.

The attack flow involves sending crafted RPC requests that cause the service to allocate resources without proper limits. As resources become exhausted, the RPC service becomes unresponsive, which can cascade to dependent Windows services and applications. The attack does not require exploitation of memory corruption or code execution—it relies purely on resource exhaustion.

Due to the sensitivity of this vulnerability and the lack of verified code examples, specific exploitation details are not provided here. Technical details can be found in the Microsoft Security Update Guide.

Detection Methods for CVE-2025-59502

Indicators of Compromise

• Unusual spikes in RPC service resource consumption (memory, CPU, handles)
• High volume of RPC traffic from single or few source IP addresses
• RPC service crashes or automatic restarts in Windows Event Logs
• Degraded performance or unresponsiveness of RPC-dependent services

Detection Strategies

• Monitor Windows Event Logs for Event ID 7031 (service crash) and Event ID 7034 (service terminated unexpectedly) related to RPC services
• Implement network monitoring to detect anomalous RPC traffic patterns on TCP port 135 and dynamic RPC ports
• Configure performance counters to alert on excessive resource usage by svchost.exe processes hosting RPC services
• Deploy intrusion detection rules to identify potential RPC-based DoS attack patterns

Monitoring Recommendations

• Enable detailed logging for the RPC service using Windows Event Tracing (ETW)
• Establish baselines for normal RPC traffic volume and resource consumption to identify deviations
• Use SentinelOne's behavioral AI to detect resource exhaustion patterns indicative of DoS attacks
• Implement alerting for RPC service health status changes across critical infrastructure

How to Mitigate CVE-2025-59502

Immediate Actions Required

• Apply the security update from Microsoft immediately to all affected Windows systems
• Prioritize patching Windows Server systems, particularly domain controllers and infrastructure servers
• Review network segmentation to limit exposure of RPC services to untrusted networks
• Enable Windows Firewall rules to restrict RPC access to authorized hosts only

Patch Information

Microsoft has released a security update to address this vulnerability. Organizations should apply the patch available through Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog. For complete patch details and download links, refer to the Microsoft Security Update Guide for CVE-2025-59502.

Workarounds

• Implement firewall rules to block external access to RPC ports (TCP 135 and dynamic high ports) where possible
• Use IPsec policies to restrict RPC communication to authenticated and authorized systems only
• Consider network segmentation to isolate critical servers from untrusted network segments
• Monitor and rate-limit incoming RPC connections at network perimeter devices

# Example: Block external RPC access using Windows Firewall
netsh advfirewall firewall add rule name="Block External RPC" dir=in action=block protocol=tcp localport=135 remoteip=any
netsh advfirewall firewall add rule name="Allow Internal RPC" dir=in action=allow protocol=tcp localport=135 remoteip=localsubnet