Windows CVE-2025-32725

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates high real-world exploitability: network accessibility from any source (AV:N), low attack complexity requiring no special conditions (AC:L), no privileges or authentication needed (PR:N/UI:N), and high availability impact (A:H) within the affected system. The absence of confidentiality or integrity impact (C:N/I:N) limits the vulnerability to denial-of-service rather than data breach. Risk assessment synthesis: (1) High exploitability factors: unauthenticated, network-accessible attack with low complexity; (2) Infrastructure criticality: DHCP is essential for network operations, and service denial affects all clients; (3) Missing signals: EPSS probability, KEV inclusion status, and POC availability are not provided, limiting quantification of active threat landscape; (4) SSVC assessment: exploitation is likely automatable given the network nature and lack of authentication, technical impact is high (service denial), affecting mission-critical infrastructure. Conservative assessment: CRITICAL priority given infrastructure role, despite limited data on active exploitation.

An unauthenticated attacker positioned on the network (or external with network access) sends a crafted sequence of malformed or excessive DHCP requests to the Windows DHCP Server (UDP port 67). The vulnerability in the protection mechanism allows these requests to consume server resources without being properly rate-limited or validated. For example: (1) Attacker floods the DHCP server with DHCP DISCOVER packets with invalid or resource-intensive payloads; (2) Server's insufficient protection mechanism fails to drop/rate-limit these packets, causing memory exhaustion, CPU saturation, or state table overflow; (3) DHCP server becomes unresponsive, preventing legitimate clients from obtaining IP leases; (4) Network-connected devices lose connectivity or experience prolonged DHCP timeout delays, cascading to application failures and business disruption. The attack requires no authentication, user interaction, or special privileges—a single attacker script can impact entire network segments. Likelihood of POC: high, given the straightforward nature of network-based DoS attacks; exploit code likely exists in security research communities or will emerge post-disclosure.