A newly discovered security flaw in the Lightweight Directory Access Protocol (LDAP) allows attackers to execute malicious code remotely on Windows systems without any user interaction.

On its February Patch Tuesday, Microsoft addressed multiple security vulnerabilities across its products, including a critical flaw in LDAP. This vulnerability affects not only Windows 10 and Windows 11 but also all major Windows Server versions. If exploited, attackers could execute remote code on a targeted system.

The flaw, identified as CVE-2025-21376, has been assigned a CVSS severity score of 8.1, categorizing it as a high-risk vulnerability. The score is slightly reduced due to the attack’s complexity. Microsoft explains that successful exploitation requires an attacker to win a race condition, which adds difficulty to executing the attack.

High Risk Despite Complex Exploitation
While there have been no confirmed cases of active exploitation, Microsoft warns that attacks leveraging this vulnerability are likely to emerge.

According to Microsoft’s security advisory, the vulnerability enables an attacker to trigger a buffer overflow (CWE-122) by sending a specially crafted request to a targeted system. This can result in remote code execution without requiring authentication. The attack can be carried out over a network, and no prior access credentials are needed.

Wormable Potential Raises Concern
One of the most alarming aspects of this flaw is that no user interaction is required for execution. Dustin Childs of Trend Micro’s Zero Day Initiative (ZDI) has flagged this vulnerability as “wormable.”

This means that once a system is infected, the exploit could potentially spread automatically to other vulnerable devices within the network, similar to the way computer worms operate. Such a scenario could lead to widespread and rapid compromise of interconnected systems.

Patch Deployment Urged
On February 11, Microsoft released patches for all affected Windows versions, including Windows 10, Windows 11, and Windows Server editions 2008 (R2), 2012 (R2), 2016, 2019, 2022, and 2025. Administrators are strongly advised to apply these security updates as soon as possible to mitigate the risk of exploitation.