Windows EUVD-2025-17742

CVSS 7.5 (High) indicates substantial impact: the availability impact rating (A:H) reflects complete service unavailability. The attack vector (AV:N), attack complexity (AC:L), and privilege requirements (PR:N) all favor attacker success—this is a straightforward remote exploit requiring no credentials or user interaction. However, the risk profile is incomplete without: (1) EPSS score—if EPSS >0.5, this becomes actively exploitable at scale; (2) KEV (CISA Known Exploited Vulnerabilities) status—inclusion would signal real-world active exploitation; (3) POC availability—public exploits accelerate adoption by threat actors. The vulnerability's real risk hinges on automation potential: since lsasrv is a core system service, any availability impact triggers cascading failures (domain logons fail, Group Policy updates halt, system authentication breaks). This is a critical priority IF actively exploited or if EPSS indicates high likelihood; it remains a high-priority patch target even without exploitation data due to the fundamental role of LSA in Windows security.

An attacker on the network sends a series of specially crafted requests to the LSA service on a target Windows server (e.g., domain controller). Due to improper access control, the service accepts these requests without authentication. The requests trigger a resource exhaustion condition (e.g., memory leak, CPU spin, or handle exhaustion) or crash the lsasrv.exe process. Result: the LSA service becomes unavailable; users cannot authenticate to the domain; Group Policy stops updating; domain-joined systems cannot verify credentials. On a domain controller, this cascades to prevent all domain logons organization-wide. Attack complexity is low—no specialized privilege or user interaction required—making this exploitable by automated tools. If a public POC exists, the attack becomes trivially reproducible by large attacker populations.