Back to board Open MSRC
MSRC compact vulnerability detail

CVE-2025-29954 · Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

Severity
Important
Impact
Denial of Service
CVSS
5.9 base · 5.2 temporal
Release
2025-05-13
Signals
Windows LDAP - Lightweight Directory Access Protocol Denial of Service Exploited: No Publicly disclosed: No Exploitability: Exploitation Unlikely
CWE
CWE-400: Uncontrolled Resource Consumption
Patch Diff
Loading module diff metadata...
Resolved binary override
Use this when the MSRC module name cannot be mapped automatically or the resolved binary looks wrong.
Old version New version
Description
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
FAQ / Articles
FAQ-CVSS-AC:H-Invest Time
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to invest time in repeated exploitation attempts through sending constant or intermittent data.
Windows LDAP - Lightweight Directory Access Protocol Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
Windows LDAP - Lightweight Directory Access Protocol Denial of Service Vulnerability
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
FAQ
Are there additional actions I need to take to harden my system against unauthenticated RPC calls? Possibly. Refer to KB5066014—Netlogon RPC Hardening (CVE-2025-49716) - Microsoft Support for additional follow-up actions you might need to take.
RevisionNote
Added an FAQ to provide a link to KB5066014—Netlogon RPC Hardening (CVE-2025-49716) - Microsoft Support. The article provides further guidance for hardening systems against unauthenticated RPC calls. This is an informational change only.