CVE-2024-21356

Deeper analysis

Windows LDAP, the Lightweight Directory Access Protocol implementation in Microsoft Windows, contains a denial-of-service vulnerability tracked as CVE-2024-21356. The flaw is associated with CWE-476 and carries a CVSS 3.1 score of 6.5, reflecting a network-accessible vector with low attack complexity and low required privileges that produces a high impact on availability while leaving confidentiality and integrity unaffected.

An authenticated attacker with low privileges can send specially crafted LDAP requests over the network to trigger the vulnerability, resulting in a denial-of-service condition that disrupts directory services without any user interaction required. The attack does not grant code execution or data access, but can render LDAP-dependent operations unavailable.

Microsoft has published an advisory for CVE-2024-21356 on its Security Response Center site that addresses the issue. The associated EPSS score has remained flat at 0.0533 with no material increase since disclosure.