CVE-2024-49113

CVE-2024-49113 is an unauthenticated denial-of-service vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) implementation, caused by an out-of-bounds read (CWE-125) and rated 7.5 (high) with network reachability, no privileges and no user interaction required. An attacker who can send crafted LDAP traffic to an affected Windows system can trigger the flaw, crashing the LSASS process; on domain controllers this crashes LSASS and reboots the server, taking authentication and directory services offline. Follow-up research ("Win-DDoS") also showed that internet-exposed domain controllers can be abused as DDoS amplification/reflection agents, extending the impact beyond a single-host outage. Affected systems span essentially all supported Windows clients and servers, from Windows 10 1507 and Windows Server 2008 through Windows 11 24H2 and Windows Server 2022. A public proof-of-concept exploit ("LDAPNightmare") demonstrating an LSASS crash and domain controller reboot has been widely reported; the flaw is not yet in CISA's KEV, but EPSS places it in the 100th percentile with an 83% probability of exploitation within 30 days.

What to do: Apply the January 2025 Microsoft security updates for CVE-2024-49113, prioritizing domain controllers and other internet-reachable Windows servers. Reduce exposure by not publishing LDAP (389/636) directly to the internet, restricting outbound LDAP referral traffic/egress from domain controllers, and monitoring for LSASS crashes and unexpected reboots. When validating with PoC tooling, use only trusted sources, as fake PoC repositories distributing infostealers and RATs have been reported targeting researchers.