CVE-2025-26673
📋 TL;DR
This vulnerability allows an unauthorized attacker to cause a denial of service (DoS) on Windows systems by exploiting uncontrolled resource consumption in the LDAP service. Attackers can send specially crafted requests that exhaust system resources, making LDAP services unavailable. All Windows systems running vulnerable LDAP implementations are affected.
💻 Affected Systems
- Windows LDAP implementation
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete LDAP service outage across the network, preventing authentication, directory lookups, and other LDAP-dependent services, potentially causing widespread operational disruption.
Likely Case
Targeted LDAP service degradation or outage affecting specific servers, disrupting authentication and directory services for dependent applications.
If Mitigated
Limited impact with proper network segmentation and rate limiting, potentially causing temporary performance degradation but not complete service failure.
🎯 Exploit Status
The vulnerability requires network access to LDAP services but no authentication. Exploitation involves sending resource-intensive LDAP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26673
Restart Required: Yes
Instructions:
1. Review Microsoft Security Update Guide for affected versions. 2. Download and install the appropriate security update from Windows Update or Microsoft Update Catalog. 3. Restart affected systems as required.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to LDAP services to only trusted sources using firewalls or network security groups.
Rate Limiting
allImplement network-level rate limiting for LDAP traffic to prevent resource exhaustion attacks.
🧯 If You Can't Patch
- Implement strict network access controls to limit LDAP exposure to only necessary systems
- Monitor LDAP service performance and resource usage for signs of attack
🔍 How to Verify
Check if Vulnerable:
Check Windows Update history for the specific security update KB number mentioned in Microsoft advisoryCheck Version:
wmic os get version, buildnumber, csdversionVerify Fix Applied:
Verify the security update is installed via Windows Update history or by checking system version📡 Detection & Monitoring
Log Indicators:
- Unusual LDAP request patterns
- High LDAP service resource usage
- LDAP service failures or restarts
Network Indicators:
- High volume of LDAP requests from single sources
- Unusual LDAP query patterns
SIEM Query:
source="windows" AND (event_id=4625 OR event_id=4771) AND ldap* | stats count by src_ip dest_ip