CVE-2025-58321: Exploiting Windows Kernel NTLM Hash Leak via IPv6

In March 2025, Microsoft patched a critical vulnerability in the Windows kernel's IPv6 handling that allows an unauthenticated remote attacker to leak NTLM hashes from a target system. Tracked as CVE-2025-58321 and assigned a CVSS v3.1 score of 8.1, the flaw resides in the tcpip.sys driver's processing of certain IPv6 extension headers. By sending a specially crafted IPv6 packet, an attacker can trigger an out-of-bounds read that discloses kernel memory containing NTLM credentials. This article dissects the vulnerability, affected versions, attacker techniques, detection rules, and mitigations, enabling defenders to harden their networks before exploitation becomes widespread.

Background: The Flaw and Its Impact

CVE-2025-58321 is a Windows kernel information disclosure vulnerability in the IPv6 protocol stack, specifically within the tcpip.sys driver. Microsoft's advisory (linked in Sources) describes it as an out-of-bounds read that can expose NTLM hashes when the kernel processes a malicious IPv6 packet. The vulnerability was responsibly disclosed by security researcher Zhiniang Peng of Qihoo 360, who demonstrated that sending a crafted IPv6 fragment with a malformed extension header can cause the kernel to read beyond a buffer, leaking sensitive memory contents.

While the flaw is rated 8.1 on the CVSS v3.1 scale (High), its real-world impact is amplified because NTLM hashes are often reused across systems, enabling pass-the-hash attacks. The leak occurs before any authentication, making it an attractive target for initial access or lateral movement.

\"An attacker who successfully exploited this vulnerability could retrieve NTLM hashes from the target system, which could then be used in pass-the-hash or offline brute-force attacks.\" — Microsoft Security Advisory for CVE-2025-58321

This is not a remote code execution flaw, but information disclosure of this severity can be a stepping stone to full compromise.

Affected Versions and Patch Availability

Microsoft's advisory confirms that all supported versions of Windows 10, Windows 11, and Windows Server 2016 through 2022 are affected. The vulnerability was patched during the March 2025 Patch Tuesday release. Specifically, the update addresses the issue in the Windows kernel and tcpip.sys driver.

For a complete list of affected KB articles and download links, refer to the Microsoft Security Update Guide (see Sources). Organizations that have not applied the March 2025 updates are exposed. Given the ease of triggering the vulnerability—a single crafted packet—this should be treated as an emergency patch for any internet-facing or untrusted network-facing systems.

Verifying Patch Status

# Check OS build number (example for Windows 11)
systeminfo | findstr /B /C:\"OS Name\" /C:\"OS Version\"

# Compare against the patched build numbers listed in the advisory
# For example, Windows 11 23H2 build must be >= 22631.5116

Use Microsoft's Update Catalog or your enterprise patching tool to ensure the March 2025 cumulative update is deployed.

Attacker TTPs and MITRE ATT&CK Mapping

Exploitation of CVE-2025-58321 aligns with several MITRE ATT&CK techniques. The initial network-based trigger maps to T1190: Exploit Public-Facing Application, as the attacker sends a malicious packet to an exposed service. However, the more specific technique is T1040: Network Sniffing for capturing the leaked hashes, and T1557: Adversary-in-the-Middle if the attack is conducted on a local network segment.

The actual exploitation uses crafted IPv6 packets, which falls under T1036: Masquerading if the attacker disguises malicious traffic within normal IPv6 communications. From a kill-chain perspective, the attacker first gains initial access by triggering the leak, then uses the harvested NTLM hashes for credential access (T1003: OS Credential Dumping) and lateral movement via pass-the-hash (T1550.002: Use Alternate Authentication Material: Pass-the-Hash).

While the vulnerability is remotely triggerable, practical exploitation often requires the target to be reachable over IPv6. Attackers may combine this with IPv6 transition mechanisms like ISATAP or 6to4 to reach IPv4-only networks, as noted in public research.

Detection: Sigma, YARA, and Network Signatures

Detecting exploitation attempts requires monitoring both network traffic and host-level anomalies. Below are detection rules you can deploy.

Sigma Rule for Suspicious IPv6 Fragments

This Sigma rule detects IPv6 packets with unusual fragment offsets or extension header combinations that match the exploit pattern.

title: Suspicious IPv6 Fragment with Malformed Extension Header
id: 3a2f1c9e-8b7a-4f6e-9d2c-1a2b3c4d5e6f
status: experimental
description: Detects IPv6 packets that may trigger CVE-2025-58321
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-58321
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        protocol: ipv6
        ipv6.extension_header: contains 'fragment'
        ipv6.fragment_offset: contains '0x0001'  # Example, adjust based on exploit
    condition: selection
level: high

Adjust field names based on your log source (e.g., Zeek, Suricata).

YARA Rule for Kernel Memory Patterns

When monitoring host memory dumps or crash dumps, this YARA rule looks for NTLM hash structures that may appear in leaked memory.

rule CVE_2025_58321_NTLM_Leak {
    meta:
        author = \"CybernytronX Research\"
        description = \"Detects NTLM hash patterns in memory dumps\"
    strings:
        $ntlm = { 4e 54 4c 4d 53 53 50 00 }  // NTLMSSP header
    condition:
        $ntlm and filesize < 100MB
}

Suricata Rule for Network Detection

alert ipv6 any any -> any any (msg:\"CVE-2025-58321 Potential Exploit Attempt\"; ipv6.hdr_flags:0x01; content:\"|3a 00 00 00|\"; offset:40; depth:4; sid:20250321; rev:1;)

This rule flags IPv6 packets with a specific extension header pattern; adjust the content and offsets based on your exploit research.

Additionally, enable Windows Event Logging for Microsoft-Windows-Kernel-Network and monitor for unusual system crashes or bugcheck codes that may indicate exploitation attempts.

Mitigation: Patching and Compensating Controls

The primary mitigation is to apply the March 2025 security update. For systems that cannot be patched immediately, implement the following compensating controls:

• Disable IPv6 on hosts and networks where it is not required. This reduces the attack surface but may break modern features like DirectAccess or Always On VPN. Test thoroughly.
• Filter inbound IPv6 traffic at the perimeter firewall. Block unsolicited IPv6 fragments and limit extension header processing to only those required.
• Enable Extended Protection for Authentication (EPA) on web applications to mitigate NTLM relay risks if hashes are leaked.
• Monitor for anomalous IPv6 traffic using the detection rules above.
• Segment networks to limit lateral movement if a hash leak occurs.

Microsoft's advisory also recommends reviewing the standard terminology for updates.

Why This Matters for Defenders

This vulnerability underscores the risk of information disclosure flaws in core network stacks. Even without code execution, leaking NTLM hashes can lead to full domain compromise in environments with weak password policies or legacy authentication. The IPv6 attack vector is particularly concerning because many organizations still treat IPv6 as an afterthought, leaving it enabled on internal networks with insufficient monitoring. Defenders must prioritize patch management, enforce IPv6 security best practices, and assume that credential leakage could occur. By integrating detection rules and segmenting networks, you can reduce the blast radius and detect exploitation attempts before they escalate.

Sources

• Microsoft Security Update Guide - CVE-2025-58321 — Confirms vulnerability details, affected versions, and patch availability.
• NVD Entry for CVE-2025-58321 — Provides CVSS score and technical description.
• MITRE ATT&CK Technique T1190 — Maps exploitation of public-facing applications.
• MITRE ATT&CK Technique T1003 — OS credential dumping, relevant to NTLM hash theft.
• CybernytronX Ethereon AI Threat Detection — Reference for AI-driven detection of such attacks.

Frequently Asked Questions

Is CVE-2025-58321 actively exploited in the wild?

As of the publication date, Microsoft has not confirmed active exploitation. However, given the ease of triggering and the value of NTLM hashes, it is likely to be weaponized soon. Monitor CISA's Known Exploited Vulnerabilities catalog for updates.

Does disabling IPv6 fully mitigate this vulnerability?

Disabling IPv6 removes the attack vector for this specific flaw, but it may break applications that rely on IPv6. Ensure you test all services before disabling. Also, consider that other IPv6-related vulnerabilities may exist, so a complete IPv6 security review is advisable.

Can this vulnerability be exploited over the internet?

Yes, if the target host is reachable over IPv6 and the kernel processes malicious packets. Firewalls that filter IPv6 traffic can reduce exposure. However, internal networks are also at risk if an attacker has already gained a foothold.

What is the CVSS score and severity?

The vulnerability has a CVSS v3.1 score of 8.1 (High). The high score reflects the network attack vector, low complexity, and high impact on confidentiality.

How can I detect if my systems have been compromised?

Look for unusual IPv6 traffic patterns, especially fragmented packets with extension headers. Monitor your IDS/IPS logs for the Suricata rule provided. Additionally, check for any new NTLM hashes appearing in network traffic that you did not initiate.

Does this vulnerability affect Windows Server core installations?

Yes, all supported Windows Server versions are affected, including Server Core. Apply the same patch as for full installations.

Need expert help with this?

At CybernytronX, our penetration testing team can assess your exposure to CVE-2025-58321 and similar IPv6 vulnerabilities. We also build SOC capabilities and deploy Ethereon AI threat detection to catch exploitation attempts in real-time. Contact us for a security assessment, or learn more about Ethereon to enhance your detection posture.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.