CVE-2025-21351
Published: 11 February 2025
Summary
CVE-2025-21351 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 8.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-21351 is a denial-of-service vulnerability in the Windows Active Directory Domain Services API, assigned CWE-400 for uncontrolled resource consumption. It carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and no required privileges or user interaction, resulting in high impact to availability while leaving confidentiality and integrity unaffected.
An unauthenticated attacker with network access can send specially crafted requests to the affected API, triggering excessive resource consumption that renders the service unavailable. Successful exploitation therefore allows remote disruption of Active Directory operations without any authentication or user assistance.
The sole reference points to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21351, which is the authoritative source for patch availability and mitigation guidance. Exploitation probability rose from a low baseline to a peak of 0.2208 on 2025-12-11 before receding to the current 0.0696, indicating a clear post-disclosure increase in interest that warrants renewed monitoring.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2416
Vulnerability details
Windows Active Directory Domain Services API Denial of Service Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated network DoS via resource consumption in AD DS API, directly mapping to application/system exploitation for endpoint denial of service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring timely installation of Microsoft patches for the Active Directory Domain Services API flaw.
Provides denial-of-service protections such as rate limiting and traffic anomaly detection to block exploitation of the API's uncontrolled resource consumption.
Protects system resources from depletion by monitoring usage and allocation to counter the CWE-400 resource exhaustion in the Domain Services API.