CVE-2024-49113LDAPNightmare, domain-controller DoS via crafted LDAP response
What broke
Windows LDAP client code could be crashed by a crafted LDAP response. Against a domain controller, that is an authentication outage. SafeBreach published a public PoC in January 2025 under the name LDAPNightmare. Microsoft patched in December 2024. CVE-2024-49112 is the related critical LDAP RCE-class sibling.
Why it matters
LDAP is how almost every on-prem identity integration still binds. Taking the DC's LDAP client (or the DC itself) offline is an identity incident: SSO fails, lockouts spike, and help desks get phished. A public PoC in January 2025 kept this in the 2025 defender window.
What to do
- Confirm December 2024 LDAP updates are on every DC and management jump box.
- Restrict which hosts a DC will accept LDAP referrals and callbacks from.
- Watch for sudden LSASS / LDAP-client crashes after a referral to an unknown host.
After you patch
Directory service flaws reach the system that answers "who is this" for everything else, so scope the response to the directory rather than the host.
- Review privileged group membership and delegation rights for changes during the exposure window.
- Rotate service account credentials used for directory binds, which are frequently stored in plaintext in application configuration. See service account.
- Check for newly created accounts and computer objects, the standard persistence step after directory access.
- Confirm LDAP signing and channel binding are enforced, since relay attacks against unsigned binds are the recurring follow-on. See lateral movement.
Sources
- NVD: CVE-2024-49113
- SafeBreach, LDAPNightmare PoC, January 2025
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault LDAP MFA enforcement bypass
Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the origina
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa