CVE-2025-32724

—

CVSS 3.1

7.5 high

EPSS

2%p76

Published

Jun 10, 2025 (Jun 10, 2025)

Modified

Jun 17, 2026

Description

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Vendors: microsoft
Products: windows 10 1507, windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 22h2, windows 11 23h2, windows 11 24h2, windows server 2008, windows server 2012, windows server 2016, windows server 2019
Weakness: CWE-400
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news3 stories

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Help Net SecurityAug 17, 00:00 UTC · Aug 17, 2025Threat actor in the wildCVE-2025-8088 CVE-2025-53779 CVE-2025-8875+4 CVEs

New Win-DDoS Flaws Let Attackers Turn Public Domain Controllers into DDoS Botnet via RPC, LDAP

The Hacker NewsAug 17, 08:43 UTC · Aug 17, 2025Malware CVE-2025-26673 CVE-2025-32724 CVE-2025-49716+2 CVEs1

Win-DDoS: Attackers can turn public domain controllers into DDoS agents

Help Net SecurityAug 11, 00:00 UTC · Aug 11, 2025Vulnerability CVE-2025-32724 CVE-2024-49113 CVE-2025-26673+2 CVEs