Yuki Chen

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) Windows Server (affected versions not specified) **Description** A heap-based buffer overflow exists in the Windows SPNEGO Extended Negotiation (NEGOEX) security mechanism. This issue occurs due to an out-of-bounds memory read, which allows an unauthorized remote attacker to execute arbitrary code over a network. The flaw is characterized as wormable, meaning it can spread rapidly across vulnerable systems. Successful exploitation can grant the attacker full control over the system with SYSTEM privileges. **Recommendations** Apply the Microsoft security updates released in the July 2025 Patch Tuesday, specifically update KB5062553. Restrict unnecessary network exposure between systems to minimize the risk of lateral movement. Enforce the principle of least privilege across the environment.

Name of the Vulnerable Software and Affected Versions: Microsoft Digest Authentication (affected versions not specified) Description: The issue allows remote attackers to execute arbitrary code and affect the system. It is noted that any authenticated attacker could trigger this issue on domain controllers without requiring admin or other elevated privileges. The likelihood of exploitation is considered less likely. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to an integer overflow in the Microsoft Digest Authentication mechanism, which can be exploited by remote attackers to execute arbitrary code. This can affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Active Directory Domain Services (affected versions not specified) Description: The issue is related to an uncontrolled resource consumption in the Windows Active Directory Domain Services API, which can lead to a denial of service. This can be exploited by a remote attacker to cause a service disruption. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a remote code execution vulnerability in the SPNEGO Extended Negotiation (NEGOEX) security mechanism. It is associated with the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the Microsoft Digest authentication mechanism in Windows operating systems, which uses insecure methods for handling authentication data in the operating system's memory. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Lightweight Directory Access Protocol (LDAP) (affected versions not specified) Description: The issue is related to a memory use after free vulnerability in the implementation of the Lightweight Directory Access Protocol (LDAP) in Microsoft Windows operating systems. This can allow a remote attacker to execute arbitrary code. The vulnerability may be exploited by remote attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) is related to the use of insecure mechanisms for handling authentication data in the operating system's memory. This issue allows remote attackers to execute arbitrary code and affect the system. The exploitation of this vulnerability can have significant consequences for the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to the implementation of the Lightweight Directory Access Protocol (LDAP) in Windows operating systems and is associated with pointer dereference errors. Exploitation of this issue could allow a remote attacker to cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Lightweight Directory Access Protocol (LDAP) (affected versions not specified) **Description** The issue is related to a denial-of-service vulnerability in Windows Lightweight Directory Access Protocol (LDAP). This vulnerability can cause the Windows server to crash, leading to potential service disruptions. A proof-of-concept exploit has been released, demonstrating the risk. Additionally, a fake proof-of-concept exploit is being used to spread information-stealing malware, targeting security researchers. The vulnerability can be exploited by sending a specially crafted CLDAP referral response packet, causing the LSASS to crash and force a reboot. It is estimated that over 302 million services are potentially affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Lightweight Directory Access Protocol (LDAP) versions prior to the fixed version **Description** The vulnerability is related to an integer overflow in the Windows Lightweight Directory Access Protocol (LDAP) service, allowing remote attackers to execute arbitrary code and affect the system. An unauthenticated attacker can exploit this flaw by sending a specially crafted set of LDAP calls to the server, leading to arbitrary code execution. The estimated number of potentially affected devices worldwide is not explicitly mentioned, but the vulnerability has a high CVSS score, indicating a significant risk. There is no information about real-world incidents where this issue was exploited. **Recommendations** To resolve the issue, apply the patch immediately, as Microsoft's December 2024 Patch Tuesday addresses this flaw. Additionally, monitor networks for anomalous LDAP traffic, DNS SRV queries, and CLDAP responses. Restrict access to the vulnerable LDAP service to minimize the risk of exploitation. Ensure that inbound RPC connections are only allowed from trusted internal networks, and verify that domain controllers do not have direct access to the internet. Use tools or scripts to check the system for vulnerable configurations and monitor LDAP and RPC traffic for suspicious activity.

**Name of the Vulnerable Software and Affected Versions** SQL Server Native Client OLE DB Provider (affected versions not specified) **Description** The issue is related to a buffer overflow in the heap of the SQL Server Native Client OLE DB Provider. This can allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SQL Server Native Client OLE DB Provider (affected versions not specified) **Description** The issue is related to an integer overflow in the SQL Server Native Client OLE DB Provider. Exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SQL Server Native Client OLE DB Provider (affected versions not specified) **Description** The issue is related to a remote code execution vulnerability in the SQL Server Native Client OLE DB Provider. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SQL Server Native Client OLE DB Provider (affected versions not specified) **Description** The issue is related to a buffer overflow in the heap of the SQL Server Native Client OLE DB Provider. This can allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver for SQL Server (affected versions not specified) Description: The issue is related to an integer overflow in the Microsoft ODBC Driver for SQL Server library. This allows a remote attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Message Queuing (MSMQ) (affected versions not specified) **Description** The issue is related to accessing a resource through incompatible types in the Windows operating system's message queuing component. This can allow an attacker to execute arbitrary code. The estimated number of potentially affected devices worldwide is not available. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver for SQL Server (affected versions not specified) Description: The issue is related to an integer overflow in the Microsoft ODBC Driver for SQL Server library. This allows a remote attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver for SQL Server (affected versions not specified) Description: The issue is related to a buffer overflow in dynamic memory in the Microsoft ODBC Driver for SQL Server library. This can allow a remote attacker to execute arbitrary code. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Message Queuing (MSMQ) (affected versions not specified) **Description** The issue is related to insufficient access controls in the Windows operating system's message queuing component. It allows an attacker to potentially elevate their privileges. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.