CVE-2025-59257

Published: Oct 14, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.

Affected (4)

Products: Microsoft: Windows 11 24h2, Windows 11 25h2, Windows Server 2022 23h2, Windows Server 2025

4 products

Windows 11 24h2

Windows 11 25h2

Windows Server 2022 23h2

Windows Server 2025

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 11 24h2	Before 10.0.26100.6899
Microsoft Windows 11 25h2	Before 10.0.26200.6899
Microsoft Windows Server 2022 23h2	Before 10.0.25398.1913
Microsoft Windows Server 2025	Up to 10.0.26100.6899

Related CWEs

Improper Validation of Specified Type of Input

The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59257

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.