CVE-2025-21224
Published: 14 January 2025
Summary
CVE-2025-21224 is a high-severity Use After Free (CWE-416) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely flaw remediation, directly addressing the Use After Free vulnerability in Windows LPD service via Microsoft patches.
CM-7 enforces least functionality by disabling the unnecessary LPD service, eliminating the remote code execution attack surface.
SC-7 provides boundary protection to block inbound network traffic to LPD service port 515, preventing unauthenticated remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE in network-exposed Windows LPD service enables remote exploitation of public-facing apps and remote services for code execution.
NVD Description
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21224 is a Remote Code Execution vulnerability in the Windows Line Printer Daemon (LPD) Service. Published on 2025-01-14, it carries a CVSS v3.1 base score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is associated with CWEs-416 (Use After Free) and CWE-591.
Unauthenticated remote attackers can exploit this vulnerability over the network with high attack complexity and no user interaction. Successful exploitation enables arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21224 provides details on patching. Vicarius offers a detection script at https://www.vicarius.io/vsociety/posts/cve-2025-21224-remote-code-execution-vulnerability-in-windows-line-printer-daemon-service-detection-script and a mitigation script at https://www.vicarius.io/vsociety/posts/cve-2025-21224-remote-code-execution-vulnerability-in-windows-line-printer-daemon-service-mitigation-script.
Details
- CWE(s)