CVE-2025-32724
📋 TL;DR
This vulnerability allows an unauthorized attacker to cause a denial of service (DoS) in Windows LSASS (Local Security Authority Subsystem Service) by consuming excessive resources. Attackers can trigger this remotely over a network without authentication, potentially crashing LSASS and disrupting authentication services. All Windows systems running affected versions are vulnerable.
💻 Affected Systems
- Windows Local Security Authority Subsystem Service (LSASS)
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
LSASS crashes, causing complete authentication failure across the domain, preventing all users from logging in, accessing resources, or performing security operations until system restart.
Likely Case
Temporary service disruption affecting authentication for some users, potentially requiring LSASS restart and causing brief login failures.
If Mitigated
Minimal impact with proper network segmentation and monitoring; authentication services remain available with possible performance degradation.
🎯 Exploit Status
The vulnerability description suggests straightforward resource exhaustion attack that doesn't require complex exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32724
Restart Required: Yes
Instructions:
1. Open Windows Update Settings
2. Check for updates
3. Install all security updates
4. Restart the system when prompted
5. Verify LSASS service is running normally
🔧 Temporary Workarounds
Network Segmentation
windowsRestrict network access to LSASS ports (typically 88, 389, 445, 464, 636) to trusted systems only
netsh advfirewall firewall add rule name="Block LSASS Ports" dir=in action=block protocol=TCP localport=88,389,445,464,636 remoteip=any
Resource Monitoring
windowsImplement monitoring for LSASS resource consumption and restart thresholds
# Use Windows Performance Monitor to track LSASS memory and CPU usage
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to LSASS services
- Deploy additional monitoring and alerting for LSASS resource exhaustion patterns
🔍 How to Verify
Check if Vulnerable:
Check Windows version and compare against Microsoft's affected versions list in the advisoryCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history contains the relevant security patch and LSASS service is running normally📡 Detection & Monitoring
Log Indicators:
- Event ID 1000 from LSASS.exe crashes in Application logs
- High memory/CPU usage by LSASS process
- Authentication failure spikes in Security logs
Network Indicators:
- Unusual traffic patterns to LSASS ports (88, 389, 445, 464, 636)
- Multiple connection attempts to LSASS from single source
SIEM Query:
source="windows" (event_id=1000 AND process_name="lsass.exe") OR (process_name="lsass.exe" AND (memory_usage>90 OR cpu_usage>80))