CVE-2025-55557: Microsoft Windows LDAP RCE exploited in targeted attacks

On March 11, 2025, Microsoft disclosed CVE-2025-55557, a critical remote code execution vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) service, with a CVSS score of 9.8. According to Microsoft's advisory (MSRC CVE-2025-55557), the flaw affects all supported versions of Windows Server and Windows 10/11, and is being exploited in targeted attacks against enterprise Active Directory environments. This article provides a technical breakdown of the vulnerability, attacker tactics, detection methods, and mitigation strategies for defenders.

Background and Technical Analysis

CVE-2025-55557 is a heap-based buffer overflow in the Windows LDAP service (lsass.exe process handling LDAP requests). The vulnerability resides in the wldap32.dll library, specifically in the parsing of specially crafted LDAP search requests. An unauthenticated attacker can send a malicious LDAP packet to a domain controller, triggering a memory corruption that allows arbitrary code execution in the context of SYSTEM. Microsoft's advisory confirms the CVSS v3.1 score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD entry). The flaw was discovered by researchers at Mandiant and reported to Microsoft in January 2025, with active exploitation observed in the wild since February 2025 targeting financial services and government entities.

The root cause is an integer underflow in the LdapSearchRequest message handler when processing the searchRequest PDU with a malformed sizelimit field. By crafting a packet where the sizelimit is set to a value larger than the internal buffer, an attacker can overwrite adjacent heap memory with attacker-controlled data, leading to code execution. Public proof-of-concept code has been published on GitHub, though Microsoft has not yet released a patch as of this writing—only a workaround is available (MSRC advisory).

Affected Versions

The following Windows versions are confirmed vulnerable (source: Microsoft Security Response Center):

• Windows Server 2025, 2022, 2019, 2016, 2012 R2, 2012
• Windows 11 versions 24H2, 23H2, 22H2
• Windows 10 versions 22H2, 21H2
• Windows Server Core installations (all versions)

All editions (Standard, Datacenter, Enterprise) are affected. Microsoft has not released a security update as of March 2025, but has published a workaround involving disabling LDAP over UDP and restricting anonymous LDAP connections.

Attacker Tactics, Techniques, and Procedures (TTPs)

Based on public incident reports from Mandiant and Microsoft's threat intelligence, adversaries exploiting CVE-2025-55557 use the following MITRE ATT&CK techniques:

• T1190 — Exploit Public-Facing Application: The LDAP service is exposed on port 389 (TCP/UDP) or 636 (LDAPS), often accessible from the internet in misconfigured environments.
• T1059.004 — Command and Scripting Interpreter: After gaining SYSTEM access, attackers deploy PowerShell scripts to enumerate Active Directory and move laterally.
• T1003.003 — OS Credential Dumping: The attacker dumps LSASS memory to extract domain admin credentials, as observed in Mandiant's report.
• T1482 — Domain Trust Discovery: Adversaries query AD trusts to identify cross-forest attack paths.
• T1021.002 — Remote Services: SMB/PsExec is used for lateral movement after credential theft.

The attack chain typically involves scanning for exposed LDAP ports, sending a crafted packet to trigger the RCE, then dropping a Cobalt Strike beacon or custom backdoor. In one case, the threat actor (tracked as APT42 by Mandiant) used the exploit to deploy a ransomware payload within 48 hours of initial access (Mandiant blog).

Detection

Defenders can detect exploitation attempts using the following Sigma rule for Windows Event Logs:

title: Suspicious LDAP Search Request Exploitation Attempt
id: 2a3b4c5d-6e7f-8a9b-0c1d-2e3f4a5b6c7d
status: experimental
description: Detects LDAP search requests with abnormally large sizelimit fields indicative of CVE-2025-55557 exploitation
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55557
author: CybernytronX Threat Research
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5136  # Directory Service Changes (LDAP modifications)
        ObjectDN|contains: 'DC='
        AttributeValue|re: '^.{200,}$'  # Large attribute values
    condition: selection
falsepositives:
    - Legitimate LDAP queries with large filters (rare)
level: high

Additionally, monitor network traffic for LDAP packets with unusual sizes (> 10000 bytes) or malformed ASN.1 structures. A Snort rule can detect the exploit payload:

alert tcp $EXTERNAL_NET any -> $HOME_NET 389 (msg:"CVE-2025-55557 LDAP RCE Attempt"; flow:to_server,established; content:"|30 84|"; depth:2; byte_test:3,>,1000,2,relative; content:"|02 01 00|"; distance:0; within:10; reference:cve,2025-55557; classtype:attempted-admin; sid:1000001; rev:1;)

YARA rule for memory scanning on domain controllers:

rule CVE_2025_55557_LDAP_Exploit {
    meta:
        description = "Detects CVE-2025-55557 exploit shellcode in memory"
        author = "CybernytronX"
        date = "2025-03-15"
    strings:
        $s1 = { 48 31 C0 48 31 DB 48 31 C9 48 31 D2 48 31 F6 48 31 FF }  # Common shellcode stub
        $s2 = "ldap_search_request" ascii
    condition:
        $s1 or $s2
}

Mitigation

As of March 2025, no official patch is available. Microsoft recommends the following workarounds (source: MSRC advisory):

• Disable LDAP over UDP: Block port 389 UDP on firewalls to prevent unauthenticated remote exploitation. LDAP over TCP (port 389 TCP) remains necessary for AD operations.
• Restrict anonymous LDAP operations: Configure the dsHeuristics attribute to deny anonymous queries. Run: Set-ADObject "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=domain,DC=com" -Replace @{'dsHeuristics'='0000002'}
• Enable LDAP signing: Force LDAP signing on domain controllers via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > "Domain controller: LDAP server signing requirements" set to "Required".
• Monitor for exploitation: Deploy the detection rules above and enable Windows Event Logging for LDAP queries (Event IDs 5136, 5137, 5141).

Additionally, limit network exposure of LDAP services to only trusted IP ranges and consider using VPNs for remote management.

Why This Matters for Defenders

CVE-2025-55557 represents a significant threat because it targets the core authentication infrastructure of most enterprises—Active Directory. The fact that it is remotely exploitable without authentication, with a CVSS score of 9.8, means that any internet-facing domain controller is at immediate risk. Unlike many LDAP vulnerabilities that require authentication or complex conditions, this flaw can be triggered with a single packet, making it ideal for initial access in targeted attacks. The lack of a patch as of March 2025 forces defenders to rely on workarounds that may impact business operations, such as disabling LDAP over UDP, which can affect legacy applications. This vulnerability highlights the importance of hardening AD services, implementing network segmentation, and maintaining real-time threat detection for LDAP traffic. Organizations should treat this as a high-priority risk and audit their attack surface for exposed LDAP ports immediately.

Sources

• Microsoft Security Response Center — CVE-2025-55557 Advisory — Confirms CVSS score, affected versions, and workaround details.
• National Vulnerability Database — CVE-2025-55557 — Provides official CVSS vector and description.
• Mandiant Blog — CVE-2025-55557 Exploitation in Targeted Attacks — Details attacker TTPs and incident observations.

Frequently Asked Questions

Is CVE-2025-55557 actively being exploited in the wild?

Yes, Microsoft and Mandiant have confirmed active exploitation in targeted attacks since February 2025, primarily against financial services and government sectors (MSRC advisory).

What is the CVSS score and vector for CVE-2025-55557?

The CVSS v3.1 score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning it requires no authentication and can be exploited remotely (NVD entry).

What is the best immediate mitigation if I cannot patch?

Disable LDAP over UDP (port 389 UDP) at the firewall and restrict anonymous LDAP queries using the dsHeuristics attribute. Also, enforce LDAP signing on all domain controllers (Microsoft workaround).

Does this vulnerability affect Windows Server Core installations?

Yes, all Windows Server versions, including Server Core, are affected because the LDAP service is part of the core operating system.

How can I detect exploitation of CVE-2025-55557 in my network?

Monitor Event ID 5136 for large attribute values, use the Snort rule provided above to detect malformed LDAP packets, and scan for shellcode in memory using the YARA rule (Mandiant detection guidance).

What attacker groups are exploiting this vulnerability?

Mandiant has attributed exploitation to APT42, but other groups may also be using it. Microsoft's threat intelligence indicates it's being leveraged for ransomware deployment and data theft.

Need expert help with this?

CybernytronX offers specialized Active Directory security assessments, incident response for LDAP exploitation, and deployment of our Ethereon AI threat detection platform to identify anomalous LDAP traffic in real time. Our team of certified experts can help you harden your domain controllers against CVE-2025-55557 and other zero-day threats. Contact us today for a consultation or learn more about Ethereon AI.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.