CVE-2025-21224
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on Windows systems running the Line Printer Daemon (LPD) service. Attackers can exploit this use-after-free vulnerability (CWE-416) to gain SYSTEM privileges on affected systems. All Windows systems with LPD service enabled are potentially vulnerable.
💻 Affected Systems
- Windows Line Printer Daemon Service
📦 What is this software?
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the affected system, data theft, lateral movement, and persistence establishment.
Likely Case
Remote code execution leading to malware deployment, ransomware installation, or credential harvesting from the compromised system.
If Mitigated
Limited impact due to network segmentation, LPD service disabled, or proper patch management preventing exploitation.
🎯 Exploit Status
Exploitation requires network access to LPD service port (typically TCP 515). No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Windows Security Update from February 2025 or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21224
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Windows Update. 2. For enterprise environments, deploy patches via WSUS or SCCM. 3. Restart affected systems after patch installation.
🔧 Temporary Workarounds
Disable LPD Service
WindowsDisable the Line Printer Daemon service if not required for business operations
sc config lpdsvc start= disabled
sc stop lpdsvc
Block LPD Port
WindowsBlock TCP port 515 at network perimeter and internal firewalls
netsh advfirewall firewall add rule name="Block LPD" dir=in action=block protocol=TCP localport=515
🧯 If You Can't Patch
- Disable LPD service immediately on all affected systems
- Implement strict network segmentation to isolate systems with LPD service from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if LPD service is running: sc query lpdsvc | findstr "RUNNING"Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains February 2025 security updates and LPD service is either disabled or patched📡 Detection & Monitoring
Log Indicators:
- Unexpected LPD service restarts
- Security event logs showing process creation from LPD service
- Application logs showing LPD service errors
Network Indicators:
- Unusual traffic to TCP port 515
- Network connections from unexpected sources to LPD port
SIEM Query:
source="windows" AND (event_id=4688 OR event_id=7045) AND process_name="*lpdsvc*"🔗 References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21224
- https://www.vicarius.io/vsociety/posts/cve-2025-21224-remote-code-execution-vulnerability-in-windows-line-printer-daemon-service-detection-script
- https://www.vicarius.io/vsociety/posts/cve-2025-21224-remote-code-execution-vulnerability-in-windows-line-printer-daemon-service-mitigation-script
