CVE-2025-21251
Published: 14 January 2025
Summary
CVE-2025-21251 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 20.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific MSMQ flaw enabling unauthenticated remote denial-of-service exploitation by applying vendor patches.
Implements denial-of-service protections at network boundaries to block or mitigate resource exhaustion attacks on MSMQ.
Enforces boundary protection to restrict unauthenticated network access to MSMQ ports and services, preventing remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote unauthenticated exploitation of MSMQ leading to availability impact via resource exhaustion or crash, directly matching application/system exploitation for endpoint DoS.
NVD Description
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Deeper analysisAI
CVE-2025-21251 is a Denial of Service vulnerability in Microsoft Message Queuing (MSMQ). Published on 2025-01-14T18:15:42.867, it is associated with CWE-400 and NVD-CWE-noinfo, carrying a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity and no user interaction required. Successful exploitation leads to high impact on availability, potentially causing denial of service, while having no impact on confidentiality or integrity.
Microsoft's advisory provides details on mitigation; see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21251.
Details
- CWE(s)