Windows LSASS CVE-2026-40378

No special conditions - remote unauthenticated exploitation against default configurations of Windows LSASS (AV:N/AC:L/PR:N/UI:N). The only prerequisite is network reachability to the target host's LSASS-exposed authentication service; no credentials, no user interaction, and no non-default feature toggle are required per the CVSS vector. Limiting factors that reduce real-world risk: the target must be network-reachable, so hosts behind firewalls or network segmentation that block untrusted access to authentication ports are not exposed; impact is confined to availability (service crash / DoS) with no data exposure or code execution, and any missing host among the enumerated Windows 10/11 and Server 2012-2025 versions is out of scope.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) indicates a remotely reachable, low-complexity, unauthenticated availability-only attack - a realistic and easily repeatable DoS. CISA's SSVC framework aligns: Exploitation is 'none' (no observed exploitation), but Automatable is 'yes' (the trigger can be scripted and sprayed across many hosts) and Technical Impact is 'partial' (consistent with availability-only, no code execution or data exposure). No EPSS score was provided, and the CVE is not in CISA KEV, so there is no public exploit identified at time of analysis. The signals are internally consistent: this is a genuine patch-worthy availability risk rather than a critical RCE, and its priority rises for internet-facing or domain-critical hosts where an LSASS crash disrupts authentication, but it does not enable compromise of data or systems. Note: the input Tags include a spurious 'Authentication Bypass' label that contradicts the description and CVSS (C:N/I:N) - this appears to be metadata noise and should not be treated as an integrity/auth-bypass vulnerability; verify with the Microsoft advisory.

An attacker with network reachability to an unpatched Windows host sends a crafted authentication-related request containing a malicious oversized length field, causing LSASS to attempt an excessive memory allocation and crash. Because LSASS underpins logon and token issuance, the crash disrupts authentication and can destabilize or reboot the host; the attack requires no credentials or user interaction and, being automatable, can be scripted against many hosts. No public exploit is identified at time of analysis.