CVE-2024-49113: Windows LDAP out-of-bounds read causes denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 with a network, unauthenticated, no-interaction vector and an EPSS above the 99th percentile make this a high-priority availability threat despite no KEV listing.

What it is

Windows LDAP contains an out-of-bounds read (CWE-125) that lets an unauthenticated remote attacker crash or degrade the LDAP service. The flaw affects a broad set of Windows client and server releases, so any exposed LDAP endpoint is a candidate target.

Impact

An attacker can cause a denial of service against the LDAP service, disrupting directory authentication and related operations on the host. The vector shows no confidentiality or integrity impact, only availability loss.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), meaning a remote unauthenticated sender can trigger it directly against an LDAP service.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.836 (99.67th percentile), indicating strong predicted exploitation activity.

What to do

• Apply the Microsoft security update for CVE-2024-49113 on all affected Windows client and server versions.
• Restrict network access to LDAP ports (389/636) to trusted hosts and block them at the perimeter where not required.
• Enable LDAP signing and channel binding, and require TLS for LDAP traffic to reduce exposure to malformed requests.
• Monitor LDAP service health and restart or fail over affected directory services if crashes are observed.
• Inventory all listed Windows versions and prioritize internet-facing or domain-controller systems for patching.

Detection

• Monitor Windows event logs for unexpected LDAP service crashes or restarts (e.g., directory service and application error events).
• Alert on spikes in malformed or anomalous LDAP requests to ports 389 and 636 from untrusted sources.
• Track availability gaps in LDAP-dependent authentication and correlate with network traffic to LDAP endpoints.
• Use network monitoring to flag unusual LDAP packet patterns or repeated connection attempts from single external hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.