Windows LSM CVE-2025-59257

Exploitation requires the attacker to have valid low-privileged authentication (PR:L) and network reachability to the Windows Local Session Manager (LSM) service on an affected host (Windows 11 24H2/25H2, Windows Server 2022 23H2, or Windows Server 2025); the attacker then sends input of a specified type that LSM fails to validate properly (CWE-1287). No user interaction is required (UI:N), but the authentication prerequisite is the primary limiting factor - anonymous, fully unauthenticated exploitation is not possible per the CVSS vector. Impact is limited to denial of service (A:H); there is no path to data disclosure or code integrity loss, bounding the realistic consequence to service disruption.

This is a moderate-severity availability vulnerability (CVSS 6.5) in Windows Local Session Manager, with the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicating network-reachable, low-complexity exploitation that nonetheless requires low-level authentication (PR:L) and yields only a denial-of-service impact (A:H) with no confidentiality or integrity loss. The EPSS score of 1.51% (74th percentile) is modest in absolute terms but above-median relative to the broader CVE population, suggesting slightly elevated-than-average but not imminent exploitation likelihood. There is no CISA KEV listing and no public proof-of-concept identified, so this is not confirmed as actively exploited. The authentication requirement (PR:L) meaningfully constrains real-world risk: an attacker must already possess valid, if low-privileged, credentials, which limits this to insiders, compromised accounts, or post-foothold lateral scenarios rather than anonymous internet-facing mass exploitation. One data inconsistency must be flagged: the input Tags label this as 'Information Disclosure,' but the CVSS vector (C:N/I:N/A:H) and the description ('deny service') describe a pure availability/denial-of-service issue with no disclosure component - the tag is mislabeled and should not drive triage. Overall this is a legitimate but non-urgent patch-cycle priority rather than an emergency, best weighted by the enormous Windows deployment footprint rather than by exploitation signals.

A low-privileged but authenticated attacker on the network sends specially crafted input to the Windows Local Session Manager service, exploiting improper validation of a specified input type to crash or hang the service and deny session management functionality to legitimate users. Because the attack vector is network-based with low complexity, it can be triggered remotely, but the attacker must first hold valid low-level credentials (PR:L). No public exploit code has been identified at time of analysis.