External risk intelligence

Windows Lightweight Directory Access Protocol Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-49112

This vulnerability affects the Windows LDAP service. While LDAP is a network-accessible protocol, it is a core directory service designed to operate within an internal, authenticated domain environment. Exposing LDAP directly to the public internet is a dangerous misconfiguration, not a standard or recommended deployment pattern. Therefore, while network-reachable, direct public exposure is uncommon.

Integer Overflow

Microsoft Windows 10 1507

before 10.0.10240.20857before 10.0.14393.7606before 10.0.17763.6659before 10.0.19044.5247before 10.0.19045.5247before 10.0.22621.4602before 10.0.26100.2605r2before 10.0.20348.2966;...

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) could allow an attacker to execute code remotely on affected systems. This issue impacts various versions of Windows operating systems, including servers and desktops. Given the potential for remote code execution, understanding the exposure of this vulnerability within your environment is important.

Issue: Code execution flaw in Windows network directory service.
Why remember: Affects many Windows versions, critical severity.
Executive takeaway: Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable Windows system's Lightweight Directory Access Protocol (LDAP) service. This could allow the attacker to execute arbitrary code on the targeted system, potentially leading to a complete compromise.

No authentication required.
Triggered by a malicious LDAP request.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Windows Lightweight Directory Access Protocol (LDAP) could allow an unauthenticated attacker to execute arbitrary code remotely. This could occur when an attacker sends a specially crafted request to a vulnerable LDAP service. The successful exploitation may lead to a full compromise of the affected system.

Data/system asset at risk: LDAP data and system integrity.
How exposure could happen: Sending specially crafted LDAP requests.
Realistic consequence: Remote code execution on the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affecting Windows LDAP can be addressed by teams responsible for Windows Server and client operating systems. The initial practical move is to identify all instances of the affected Windows versions, determine their business criticality and network exposure, and then confirm the accountable owner for each system. Subsequent remediation planning should prioritize systems based on this risk assessment.

Windows Server and client OS owners.
Confirm network exposure and criticality.
Plan targeted remediation by risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows LDAP service and how is it used?

The Lightweight Directory Access Protocol (LDAP) is a standard service within Windows environments that functions as a directory. It is primarily used to manage, look up, and authenticate users, computers, and other resources within a domain network. It acts as the backbone for organizational identity management, allowing systems and applications to communicate and verify credentials across the network.

What is the weakness class for CVE-2024-49112?

CVE-2024-49112 is identified by the weakness class CWE-190, which refers to an integer overflow or wraparound. In the context of this LDAP vulnerability, this means the software may perform a calculation that results in a value too large for its intended storage, leading to an error. An attacker can leverage this logical flaw by sending a specially crafted request to trigger the unexpected behavior and achieve remote code execution.

How is CVE-2024-49112 triggered?

An unauthenticated attacker triggers this vulnerability by sending a specially crafted LDAP request to a vulnerable Windows system. The bug relies on the system's processing of these malicious packets. It is important to note that normal, legitimate LDAP traffic used for routine directory lookups or authentication within a network does not trigger this vulnerability.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that while this vulnerability involves a network-accessible protocol, it is unlikely to be exposed to the public internet in standard configurations. LDAP is designed for internal domain environments. If you have followed best practices and avoided exposing your LDAP services directly to the public, your direct risk from external, internet-based attackers is significantly reduced.

What should I do first if I run affected Windows systems?

Start by performing a comprehensive inventory of your environment to identify all systems running the affected Windows versions listed in the advisory. Once identified, categorize these systems based on their business importance and their specific network placement. Prioritize your remediation efforts by focusing on the most critical assets and those that have any form of external network connectivity.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49112

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.