EUVD-2026-22496
GHSA-mfwr-mq7p-278f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted network packet to LSASS
-
ExploitTrigger null pointer dereference in parser
-
ExecutionCrash LSASS process
-
ImpactDeny authentication services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | LSASS must be accessible over network (default on domain controllers and networked systems). No authentication required. Default Windows configurations vulnerable. |
| Impact | This vulnerability presents significant operational risk despite the absence of confidentiality or integrity impact. The CVSS 7.5 score reflects High availability impact with optimal attacker conditions: network-accessible attack vector, low complexity (AC:L), and no authentication required (PR:N). No confirmed active exploitation (CISA KEV) exists, and no public exploit code has been identified at time of analysis. However, the technical characteristics make weaponization straightforward-attackers need only craft network packets triggering the null pointer condition without authentication barriers. The critical nature of LSASS as a Windows security foundation amplifies impact: successful exploitation forces system crashes affecting business continuity, potentially disrupting entire Active Directory domains if domain controllers are targeted. SSVC decision framework indicates elevated priority: the automatable attack vector (network-reachable, no user interaction), combined with system availability impact in enterprise authentication infrastructure, justifies immediate patching. The vulnerability's simplicity (pointer dereference) and clear attack surface (network protocol handling) suggest proof-of-concept development is trivial once technical details emerge. Organizations running affected Windows versions in production, particularly domain controllers and externally-accessible systems, should treat this as urgent. |
| Exploit ScenarioDerived | Attacker sends specially crafted network packets to port exposing LSASS, causing null pointer dereference. LSASS crashes, disabling domain authentication and forcing service restart. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Remote denial-of-service in Windows Local Security Authority Subsystem Service (LSASS) allows unauthenticated network attackers to crash Windows systems through null pointer dereference exploitation. Affects Windows 10 (versions 1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025) across multiple release channels. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and unauthenticated netwo
Earlier versions of this analysis (1)
Remote denial-of-service in Windows Local Security Authority Subsystem Service (LSASS) allows unauthenticated network attackers to crash Windows systems through null pointer dereference exploitation. Affects Windows 10 (versions 1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025) across multiple release channels. Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and unauthenticated network vector (AV:N/PR:N) make this a high-priority patching target for production Windows environments.
RemediationAI
Apply vendor-released security updates immediately through Windows Update or WSUS infrastructure. Patched versions are Windows 10 Version 1607 build 10.0.14393.9060 or later, Windows 10 Version 1809 build 10.0.17763.8644 or later, Windows 10 Version 21H2 build 10.0.19044.7184 or later, Windows 10 Version 22H2 build 10.0.19045.7184 or later, Windows 11 Version 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 Version 24H2 build 10.0.26100.32690 or later, Windows 11 Version 25H2 build 10.0.26200.8246 or later, Windows 11 Version 26H1 build 10.0.28000.1836 or later, Windows Server 2016 build 10.0.14393.9060 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 build 10.0.25398.2274 or later, and Windows Server
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 30 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Windows Local Security Authority Subsystem Service (LSASS), a critical Windows operating system component responsible for authentication, Active Directory operations, and security policy enforcement. LSASS runs as a privileged system process (lsass.exe) that handles security token generation and validation. The root cause is a null pointer dereference (CWE-476), a class of memory safety error where the code attempts to access memory through a pointer that has not been initialized or has been set to NULL. In LSASS's case, network-reachable code paths can trigger this dereference when processing malformed authentication requests or security protocol messages, causing the process to crash. Since LSASS is essential to Windows security subsystem operation, its termination typically forces an immediate system reboot with a STOP error, making this an effective denial-of-service vector. The affected CPE strings indicate vulnerability spans multiple Windows kernel versions (10.0.14393 through 10.0.28000) across client and server editions, including Server Core installations.
Know when Windows Server 2016 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
CVE-2026-32071 is a high-severity remote denial-of-service vulnerability affecting Windows 10, Windows 11, and Windows Server (2016-2025) that allows unauthenticated attackers to crash systems over the network. This poses immediate operational risk to any organization relying on Windows infrastructure, as successful exploitation results in system unavailability without requiring user credentials or complex attack chains. Patching across all affected Windows versions should be prioritized to prevent widespread service disruptions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB