Identity CVE · LDAP
CVE-2024-49113LDAPNightmare, domain-controller DoS via crafted LDAP response
high
What broke
Windows LDAP client code could be crashed by a crafted LDAP response. Against a domain controller, that is an authentication outage. SafeBreach published a public PoC in January 2025 under the name LDAPNightmare. Microsoft patched in December 2024. CVE-2024-49112 is the related critical LDAP RCE-class sibling.
Why it matters
LDAP is how almost every on-prem identity integration still binds. Taking the DC's LDAP client (or the DC itself) offline is an identity incident: SSO fails, lockouts spike, and help desks get phished. A public PoC in January 2025 kept this in the 2025 defender window.
What to do
- Confirm December 2024 LDAP updates are on every DC and management jump box.
- Restrict which hosts a DC will accept LDAP referrals and callbacks from.
- Watch for sudden LSASS / LDAP-client crashes after a referral to an unknown host.
Sources
- NVD: CVE-2024-49113
- SafeBreach, LDAPNightmare PoC, January 2025
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.