What is the CVSS score of CVE-2025-32725?

CVE-2025-32725 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.9%.

Which versions of Windows are affected by CVE-2025-32725?

CVE-2025-32725 is a network-accessible denial-of-service vulnerability in Windows DHCP Server that allows unauthenticated attackers to disrupt DHCP services without authentication, potentially…. A patch is available.

How to fix or mitigate CVE-2025-32725?

Within 24 hours: Identify all Windows DHCP Server instances in your environment and verify current versions. Within 7 days: Apply vendor-released patch to all affected DHCP servers; validate patch deployment and test DHCP service functionality in a non-production environment first. Within 30 days: Complete patch deployment to all production DHCP servers and document remediation status; implement network segmentation to restrict DHCP server access to trusted administrative networks where feasible.

Windows CVE-2025-32725

EUVD-2025-17746 HIGH

Protection Mechanism Failure (CWE-693)

2025-06-10 secure@microsoft.com

Microsoft Windows Dhcp Denial Of Service Windows Server 2025 Windows Server 2019 Windows Server 2016 Windows Server 2022 23h2 Windows Server 2022

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:42 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.26100.4349,10.0.17763.7434,10.0.14393.8148

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17746

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:22 nvd

HIGH 7.5

DescriptionCVE.org

Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

AnalysisAI

Network-accessible denial-of-service vulnerability in Windows DHCP Server caused by a protection mechanism failure (CWE-693), allowing unauthenticated attackers to exhaust server availability without requiring authentication or user interaction. The vulnerability affects Windows DHCP Server implementations across multiple versions and has a CVSS severity of 7.5 (High). While the description does not explicitly reference KEV inclusion, active exploitation status, or EPSS data, the low attack complexity (AC:L) and network accessibility (AV:N) combined with no authentication requirements indicate this represents a credible denial-of-service threat to DHCP infrastructure.

Technical ContextAI

This vulnerability resides in Windows DHCP Server, a critical network infrastructure service responsible for dynamic IP address allocation via the DHCP protocol (RFC 2131/2132 operating over UDP port 67/68). The root cause is classified under CWE-693 (Protection Mechanism Failure), indicating insufficient safeguards against resource exhaustion, malformed packet handling, or inadequate request validation within the DHCP server's packet processing logic. The protection mechanism failure likely involves improper handling of DHCP requests that should be rate-limited, validated, or rejected, allowing an attacker to trigger excessive resource consumption (memory, CPU, or connection state). DHCP servers are fundamental network infrastructure present in virtually all enterprise environments; compromise of this service cascades to network unavailability.

RemediationAI

Immediate remediation steps: (1) Apply latest security patches from Microsoft for Windows DHCP Server—check Microsoft Security Bulletin and KB database for CVE-2025-32725 specific patch (expected in monthly Patch Tuesday releases); (2) Identify affected systems via Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager; (3) Test patches in non-production environments before broad deployment; (4) Temporary mitigations pending patches: implement network-level ingress filtering to restrict DHCP traffic (UDP 67/68) to authorized networks only, deploy rate-limiting rules on firewalls/network appliances to restrict DHCP request frequency, monitor DHCP server logs for anomalous request patterns, consider disabling DHCP Server role on non-essential systems. (5) Post-remediation: validate DHCP service stability and client connectivity after patching. Reference: Microsoft Security Response Center (MSRC) portal for official advisories, KB articles, and patch availability confirmation.