EUVD-2026-73026
GHSA-444q-2g28-q4rw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local exploit requiring low privileges only; heap overflow in SYSTEM-privileged lsass.exe yields full CIA impact with no complexity barriers.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows Local Security Authority Server (lsasrv.dll) enables an authenticated local attacker to escalate privileges to SYSTEM on affected Windows Server 2025 and Windows 11 systems. The vulnerability resides in a core authentication and security-policy component running under the lsass.exe process, making successful exploitation effectively equivalent to full system compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated local session on the target system with at least low-privileged access (PR:L) - the attacker must be able to execute code locally, either via an interactive logon, Remote Desktop session, or a compromised local service account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation requiring only a low-privileged shell on the target - no complexity barriers, no user interaction, and full CIA impact consistent with SYSTEM-level code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update to reach the following fixed build versions: Windows Server 2025 (including Server Core) at 10.0.26100.33438 or later; Windows 11 24H2 at 10.0.26100.9445 or later; Windows 11 25H2 at 10.0.26200.9445 or later; Windows 11 26H1 at 10.0.28000.2954 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Server 2025 and Windows 11 systems and prioritize identity infrastructure, domain controllers, and privileged access workstations where lsass.exe compromise would cascade most broadly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today