Summary
Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data.
Are there additional actions I need to take to harden my system against unauthenticated RPC calls?
Possibly. Refer to KB5066014—Netlogon RPC Hardening (CVE-2025-49716) - Microsoft Support for additional follow-up actions you might need to take.
Security updates
10.0.17763.7314 — https://support.microsoft.com/help/5058392
10.0.20348.3692 — https://support.microsoft.com/help/5058385
10.0.20348.3630 — https://support.microsoft.com/help/5058500
10.0.19044.5854 — https://support.microsoft.com/help/5058379
10.0.22621.5335 — https://support.microsoft.com/help/5058405
10.0.25398.1611 — https://support.microsoft.com/help/5058384
10.0.10240.21014 — https://support.microsoft.com/help/5058387
10.0.14393.8066 — https://support.microsoft.com/help/5058383
6.0.6003.23279 — https://support.microsoft.com/help/5058449
6.0.6003.23279 — https://support.microsoft.com/help/5058429
6.1.7601.27729 — https://support.microsoft.com/help/5058430
6.1.7601.27729 — https://support.microsoft.com/help/5058454
6.2.9200.25475 — https://support.microsoft.com/help/5058451
6.3.9600.22577 — https://support.microsoft.com/help/5058403
Vulnerabilities 1
-
Medium 5.9
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
Revision history
-
#3
Added an FAQ to provide a link to [KB5066014—Netlogon RPC Hardening (CVE-2025-49716) - Microsoft Support](https://support.microsoft.com/en-us/topic/kb5066014-netlogon-rpc-hardening-cve-2025-49716-38a0bc06-507c-47d4-be0f-ca1acab02c68). The article provides further guidance for hardening systems against unauthenticated RPC calls. This is an informational change only.
-
#2
Added an acknowledgement. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-29954 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29954
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss