PT-2025-20958 · Microsoft · Windows Ldap+1

Erik Egsgard · Published 2025-05-13 · Updated 2025-08-08 · CVE-2025-29954

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Windows LDAP versions prior to the fixed version

Description The issue is related to uncontrolled resource consumption in the Lightweight Directory Access Protocol (LDAP) of Microsoft Windows operating systems. This can be exploited by a remote attacker to cause a denial of service. The protocol allows an unauthorized attacker to deny service over a network.

Recommendations For Windows LDAP versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the LDAP service to minimize the risk of exploitation. Avoid using the vulnerable LDAP protocol until the issue is resolved.

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2025-05576

CVE-2025-29954

Affected Products

Windows

Windows Ldap

References · 10

• https://osv.dev/vulnerability/CVE-2025-29954 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29954 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29954 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-29954 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05576 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-29954 · Security Note
• https://twitter.com/windowsforum/status/1922524440102854798 · Twitter Post
• https://twitter.com/CVEnew/status/1922339798628631010 · Twitter Post
• https://t.me/msrcreports/2108 · Telegram Post
• https://t.me/cvenotify/122997 · Telegram Post