What is the CVSS score of EUVD-2025-17742?

EUVD-2025-17742 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.2%.

Which versions of Windows are affected by EUVD-2025-17742?

CVE-2025-33056 is a high-severity denial-of-service vulnerability in Microsoft's Local Security Authority Server that allows unauthenticated remote attackers to crash the LSA service, disrupting…. A patch is available.

How to fix or mitigate EUVD-2025-17742?

Within 24 hours: Identify all Windows systems running affected versions via asset inventory and prioritize domain controllers and authentication servers. Within 7 days: Apply Microsoft's vendor-released patch to all affected systems, beginning with critical authentication infrastructure; coordinate patching to minimize authentication service downtime. Within 30 days: Complete patching across all remaining Windows assets and validate LSA service functionality post-deployment.

Windows EUVD-2025-17742

| CVE-2025-33056 HIGH

Improper Access Control (CWE-284)

2025-06-10 secure@microsoft.com

Windows Denial Of Service Microsoft Windows 10 1507 Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:41 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.22621.5472,6.2.9200.25522,6.3.9600.22620

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17742

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:22 nvd

HIGH 7.5

DescriptionCVE.org

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.

AnalysisAI

Network-accessible denial-of-service vulnerability in Microsoft's Local Security Authority Server (lsasrv) caused by improper access control (CWE-284). An unauthenticated remote attacker can exploit this with low complexity to render the LSA service unavailable, affecting authentication and security policy enforcement on affected Windows systems. The CVSS 7.5 severity reflects the high availability impact; however, real-world risk depends on EPSS score, KEV candidacy status, and active exploitation data not provided in the source materials.

Technical ContextAI

The Local Security Authority Server (lsasrv) is a critical Windows system service responsible for user authentication, password changes, and security policy enforcement. It operates as a privileged system process and manages sensitive security tokens and credentials. CWE-284 (Improper Access Control) indicates the vulnerability stems from insufficient authorization checks—specifically, the service likely fails to properly validate incoming network requests, allowing an unauthenticated remote attacker to trigger resource exhaustion, infinite loops, or crash conditions via malformed or repeated requests. The service's network accessibility (AV:N) combined with lack of privilege requirements (PR:N) and no user interaction (UI:N) means any remote network actor can trigger this without authentication, making it a direct threat to Windows domain infrastructure and standalone systems.

RemediationAI

Apply Microsoft security patches for CVE-2025-33056 immediately upon availability (check Microsoft Update, Windows Update, or WSUS). 2. Prioritize patching domain controllers and authentication servers first. 3. Interim mitigations (if patch unavailable): restrict network access to LSA-related ports/services via firewall rules; implement network segmentation to limit which systems can reach LSA services; disable remote access to LSA if operationally feasible. 4. Monitor system event logs (Windows Security event ID 4719, 4625, and service-related errors) for exploitation attempts or LSA service crashes. 5. Consult Microsoft Security Response Center (MSRC) advisories for version-specific guidance. Patch availability and KB article numbers should be verified at Microsoft's official security updates page.