CVE-2025-59257: Windows Local Session Manager (LSM) Denial of Service Vulnerability

CVE-2025-59257 PUBLISHED CVSS 6.5 MEDIUM

Windows Local Session Manager (LSM) Denial of Service Vulnerability

Reported by microsoft · Published October 14, 2025

Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Vendor	Product	Versions
Microsoft	Windows 11 Version 24H2	10.0.26100.0
Microsoft	Windows 11 Version 25H2	10.0.26200.0
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0
Microsoft	Windows Server 2025	10.0.26100.0
Microsoft	Windows 11 Version 24H2	10.0.26100.0
microsoft	windows_11_25H2	10.0.26200.0
Microsoft	Windows 11 Version 25H2	10.0.26200.0
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0
microsoft	windows_11_24H2	10.0.26100.0
microsoft	windows_server_2025	10.0.26100.0
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0
microsoft	windows_server_23h2	10.0.25398.0

The same record, from the CLI:

vulnetix vdb vuln CVE-2025-59257
vulnetix vdb fixes CVE-2025-59257

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-59257/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart