Very Low
CVE-2024-49113
Very Low
(1 user assessed)
Very High
(1 user assessed)Unknown
Unknown
Unknown
CVE-2024-49113
Description
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Add Assessment
Technical Analysis
CVE-2024-49113 is a denial-of-service (DoS) vulnerability in the Windows Lightweight Directory Access Protocol (LDAP). It allows remote, unauthenticated attackers to disrupt the LDAP service on affected Windows servers, causing significant downtime by forcing reboots. The flaw, disclosed and patched in December 2024, highlights the importance of securing directory services in modern IT environments.
The vulnerability is attributed to an out-of-bounds read error in LDAP’s implementation. Attackers exploit this flaw by sending specially crafted Connectionless LDAP (CLDAP) referral response packets to the target server. These malicious packets can destabilize the Local Security Authority Subsystem Service (LSASS), leading to an immediate system crash and reboot. Exploitation does not require prior authentication or user interaction, though it depends on the target server’s internet connectivity for DNS operations.
Impacted Systems
This vulnerability affects multiple versions of Windows, including:
Client Systems: Windows 10 (various versions) and Windows 11 (22H2, 24H2). Server Systems: Windows Server editions spanning 2008 to 2025.
Organizations should consult official documentation for specific build information and patch availability.
Exploit Details and Risks
Shortly after the vulnerability’s disclosure, proof-of-concept (PoC) code demonstrating the exploitability of CVE-2024-49113 emerged. The PoC demonstrated how attackers could trigger system crashes on unpatched servers, highlighting the criticality of timely patching.
Notably, some malicious actors have distributed counterfeit PoCs on public platforms. These fake exploits contain malware designed to compromise researchers’ and defenders’ systems, emphasizing the importance of sourcing code from trusted and verified sources.
CVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 21h2,
- windows 10 22h2,
- windows 11 22h2,
- windows 11 24h2,
- windows server 2008 -,
- windows server 2008 r2,
- windows server 2012 -,
- windows server 2012 r2,
- windows server 2016,
- windows server 2019,
- windows server 2022,
- windows server 2022 23h2,
- windows server 2025
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
