BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-20

Assigner: Microsoft Corporation

Description

Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-20

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59257

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_11_24h2	to 10.0.26100.6899 (exc)
microsoft	windows_11_25h2	to 10.0.26200.6899 (exc)
microsoft	windows_server_2022_23h2	to 10.0.25398.1913 (exc)
microsoft	windows_server_2025	to 10.0.26100.6899 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by improper validation of a specified type of input in the Windows Local Session Manager (LSM). It allows an authorized attacker to cause a denial of service over a network.

Impact Analysis

An authorized attacker can exploit this vulnerability to deny service over a network, potentially disrupting availability of affected systems or services.

Hi! I’m here to help you understand CVE-2025-59257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70