CVE-2024-49113LDAPNightmare, domain-controller DoS via crafted LDAP response
What broke
Windows LDAP client code could be crashed by a crafted LDAP response. Against a domain controller, that is an authentication outage. SafeBreach published a public PoC in January 2025 under the name LDAPNightmare. Microsoft patched in December 2024. CVE-2024-49112 is the related critical LDAP RCE-class sibling.
Why it matters
LDAP is how almost every on-prem identity integration still binds. Taking the DC's LDAP client (or the DC itself) offline is an identity incident: SSO fails, lockouts spike, and help desks get phished. A public PoC in January 2025 kept this in the 2025 defender window.
What to do
- Confirm December 2024 LDAP updates are on every DC and management jump box.
- Restrict which hosts a DC will accept LDAP referrals and callbacks from.
- Watch for sudden LSASS / LDAP-client crashes after a referral to an unknown host.
After you patch
Directory service flaws reach the system that answers "who is this" for everything else, so scope the response to the directory rather than the host.
- Review privileged group membership and delegation rights for changes during the exposure window.
- Rotate service account credentials used for directory binds, which are frequently stored in plaintext in application configuration. See service account.
- Check for newly created accounts and computer objects, the standard persistence step after directory access.
- Confirm LDAP signing and channel binding are enforced, since relay attacks against unsigned binds are the recurring follow-on. See lateral movement.
Sources
- NVD: CVE-2024-49113
- SafeBreach, LDAPNightmare PoC, January 2025
Related identity CVEs
Related on Start with Identity
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as