CVE-2024-49113

What it actually does

CVE-2024-49113 is a denial-of-service vulnerability in the Windows LDAP implementation. A remote attacker can trigger abnormal behavior in LDAP/CLDAP processing that may cause the Local Security Authority Subsystem Service, lsass.exe, or related directory services on a Windows LDAP server or domain controller to crash. Because LSASS is a critical Windows process, exploitation can disrupt authentication, directory lookups, domain controller availability, and in some cases force service interruption or system restart. The assigned CVSS score is 7.5 and the EPSS score is high at approximately 0.83, indicating a significant likelihood of exploitation activity despite the vulnerability not currently being listed in CISA KEV and not being flagged as ransomware-associated.

Why it matters to the business

Successful exploitation can make Windows directory services temporarily unavailable, which may prevent users, applications, servers, and identity-dependent services from authenticating or resolving directory information. In organizations that rely on Active Directory, this can cause login failures, application outages, group policy disruption, VPN or email access issues, and broader operational downtime. The high EPSS score increases remediation urgency even though there is no KEV listing or known ransomware designation in the provided data.

How an attack unfolds

An attacker targets a Windows system exposing LDAP or CLDAP functionality, most critically a domain controller or server providing directory services. The attacker sends specially crafted LDAP-related traffic that exercises vulnerable parsing or referral-handling logic in the Windows LDAP stack. When the vulnerable code path is reached, the target service mishandles the request or response data and LSASS or a related directory service process can crash. Because LSASS is essential to authentication and security policy enforcement, the crash can interrupt domain services and may trigger a reboot or service failure. Exploitation does not require data theft or code execution to be damaging; the operational impact comes from making identity infrastructure unavailable.

How to fix it

Apply the Microsoft security updates that address CVE-2024-49113 on all affected Windows systems, prioritizing domain controllers and servers that expose LDAP, CLDAP, or LDAPS. Because no fixed version list was provided, use the applicable Microsoft December 2024 or later cumulative/security update for each supported Windows release. Reduce exposure by blocking unnecessary inbound LDAP/CLDAP access from untrusted networks, especially UDP/389 and TCP/389, and restrict LDAPS TCP/636 to trusted clients where possible. Ensure domain controllers are not directly reachable from the internet. Where patching must be staged, use network segmentation, firewall rules, VPN-only administrative access, and monitoring for anomalous LDAP traffic as compensating controls.

How to confirm the fix worked

Confirm each Windows host providing LDAP services has the Microsoft security update for CVE-2024-49113 installed, using Windows Update history, enterprise patch management, or PowerShell inventory of installed hotfixes. Validate that domain controllers and LDAP servers are not reachable from untrusted networks on TCP/389, UDP/389, or TCP/636 unless explicitly required. Perform controlled internal scans to identify exposed LDAP endpoints and compare results before and after remediation. Review recent system stability on domain controllers for LSASS crashes or unexpected reboots to determine whether exposure may have already resulted in denial-of-service attempts.

Typical attack path

1. Identify internet-exposed or internally reachable Windows LDAP/CLDAP services, commonly on TCP or UDP port 389 and potentially LDAPS on TCP port 636.
2. Confirm the target appears to be a Windows LDAP server or domain controller.
3. Send crafted LDAP or CLDAP traffic designed to trigger the vulnerable Windows LDAP processing path.
4. Cause LSASS or related directory service components to fault or terminate.
5. Leverage the resulting authentication and directory-service outage to disrupt operations, mask other activity, or create pressure during a broader intrusion.

How to detect it

Look for evidence of attempted or successful denial-of-service against Windows LDAP services. Key log sources include Windows System logs, Application logs, Directory Service logs on domain controllers, Windows Error Reporting records, endpoint detection telemetry, firewall logs, DNS logs, and network IDS or packet metadata for LDAP/CLDAP traffic. Investigate LSASS crashes, unexpected reboots of domain controllers, sudden authentication failures, and bursts of LDAP or CLDAP traffic from unusual sources. In network telemetry, pay special attention to UDP/389 CLDAP traffic, LDAP referral-like behavior, unusual outbound LDAP/CLDAP connections from domain controllers to untrusted systems, and DNS SRV lookups associated with LDAP service discovery. Correlate timestamps of LSASS faults with inbound LDAP traffic and authentication outage reports. Because this is a denial-of-service issue, exploitation evidence may be limited to crash artifacts and traffic patterns rather than persistent files or malware.

• Faulting application name: lsass.exe
• Faulting module name: wldap32.dll
• The system process 'C:\Windows\system32\lsass.exe' terminated unexpectedly
• C:\Windows\System32\lsass.exe
• Event ID 1000
• Event ID 1001
• Event ID 1015
• Exception code: 0xc0000005
• _ldap._tcp.dc._msdcs
• UDP/389
• TCP/389
• TCP/636
• CLDAP
• LDAP referral

What your security team should do

• Prioritize patching domain controllers and Windows LDAP servers because identity infrastructure outages have broad operational impact.
• Treat the high EPSS score as an urgency signal even though the vulnerability is not currently listed in CISA KEV.
• Inventory all systems listening on TCP/389, UDP/389, and TCP/636 and determine whether each exposure is necessary.
• Block LDAP and CLDAP from the internet and restrict internal access to trusted network segments and authorized systems.
• Increase monitoring for LSASS crashes, unexpected domain controller reboots, and spikes in LDAP or CLDAP traffic.
• Correlate LDAP anomalies with authentication failures, service desk reports of login issues, and Windows Error Reporting events.
• Ensure domain controller backups, recovery procedures, and emergency authentication continuity plans are current.