Windows LSASS CVE-2026-62784

Exploitation requires the attacker to hold valid, low-privileged Windows credentials (domain user or local account with network logon rights) - confirmed by CVSS PR:L and the description's phrase 'authorized attacker.' The vulnerable code path is reachable over the network without user interaction (UI:N, AV:N), meaning no victim needs to open a file or click a link. No non-default Windows configuration is indicated as a prerequisite; LSASS is active by default on all Windows systems. Exploitation is bounded by the requirement for at least low-privileged authentication: fully air-gapped systems or those with no externally reachable authentication endpoints have substantially reduced exposure. Fully isolated networks where attackers cannot obtain even low-privileged credentials are not practically at risk.

The CVSS 8.8 score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a realistic, high-priority threat: network exploitable, low complexity, requiring only low-privileged credentials - a bar any domain user clears. Full high impact across all three CIA pillars reflects the consequence of arbitrary code execution inside LSASS/SYSTEM context. The scope is unchanged (S:U), which is consistent with host-level compromise rather than automatic lateral movement, though LSASS credential access inherently facilitates further network pivoting. No EPSS score was provided, so exploitation probability is unquantified from that source. No CISA KEV listing is present, meaning active in-the-wild exploitation is not confirmed. The breadth of affected versions - 19 distinct Windows SKUs spanning Server 2012 to Server 2025 and Windows 10/11 across all major feature releases - means exposure is nearly universal across unpatched Windows estates. Given the combination of a network-accessible critical authentication component, heap overflow root cause, authenticated-but-low-bar access requirement, and full system impact, this warrants urgent patching regardless of organization size.

An attacker with any valid low-privileged Windows domain credential sends a specially crafted authentication request over the network to a vulnerable Windows host - for example, targeting a domain controller's LSASS over Kerberos or NTLM - triggering the heap-based buffer overflow in lsasrv.dll. By controlling heap layout, the attacker redirects execution flow within the LSASS process, which runs as SYSTEM, achieving arbitrary code execution on the target. No public exploit code has been identified at time of analysis, so exploitation currently likely requires specialized capability.