This exploited-in-the-wild issue is an interesting twist on binary planting that we were working on a decade and a half ago. The DLL/EXE search order just keeps on giving (to attackers, that is). https://binaryplanting.com

It turned out that all our security-adopted Windows versions were affected by this issue, so we created micropatches for them all. These are already distributed and applied to all online affected systems.

We would like to thank security researchers Alexandra Gofman and David Driker with @_cpresearch_ for detecting the exploitation and publishing their analysis, which made it possible for us to create a micropatch for this issue.

CVE-2025-29957 is a denial of service vulnerability allowing an attacker in the network to easily consume all available memory on a Windows Server with Windows Deployment Service installed. Our patch properly frees memory allocated by incoming requests (just like Microsoft's).

We would like to thank security researcher Zhiniang Peng (@edwardzpeng) for publishing their analysis, which made it possible for us to create a micropatch for this issue.

This issue is one of many issues causing an NTLM hash leak using a malicious URL file. We found it had been fixed by Microsoft with July 2023 updates, but we could not map it to a specific CVE (therefore "Unknown CVE").

The issue, however, still affects various older Windows systems that we have security-adopted, so we created patches for them.

We'd like to thank our sources researching various NTLM hash leak issues:
1) @domchell of @mdseclabs - https://mdsec.co.uk/2021/02/farming-for-red-teams-harvesting-netntlm/
2) @yorickkoster of @securifybv - https://securify.nl/en/blog/living-off-the-land-stealing-netntlm-hashes/
3) @Swepstopia: https://swepstopia.com/url-file-attack/