EUVD-2026-99297
GHSA-2h57-6pq7-qq64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach LSASS over network
-
ExploitSend malformed auth request
-
ExecutionTrigger out-of-bounds read in LSASS
-
ImpactCrash service, deny authentication
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated network exploitation against default configurations of Windows (LSASS is enabled by default on all supported client and server editions). Exploitation only requires network reachability to the vulnerable host's LSASS-facing services; there is no authentication (PR:N), user interaction (UI:N), or non-default feature requirement. Limiting factors that reduce real-world exposure: network segmentation and firewalls that block attacker access to authentication ports, and the availability-only impact (a crash/reboot) rather than code execution or data theft. Affected builds are below the patched versions listed for Windows 10/11 (1809 through 26H2) and Windows Server 2019/2022/2025; patched builds are not exploitable. |
| Impact | This is a genuine but bounded priority: a network-reachable, unauthenticated denial-of-service against Windows LSASS, a critical and always-present component whose crash can disrupt authentication for an entire host. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is self-consistent and credible - low attack complexity with no privileges or user interaction means a single crafted network request could trigger the out-of-bounds read (CWE-125) and crash the service. However, the impact is availability-only (C:N/I:N/A:H): despite the 'Information Disclosure' tag, the CVSS vector explicitly rates confidentiality impact as none, so this is NOT a data-leak bug and the tag appears mislabeled. No EPSS score, CISA KEV listing, or POC indicator was provided, so there is no evidence of active exploitation; this reads as a high-CVSS-but-not-yet-exploited patch-cycle item rather than an emergency. Net: real risk because of the ubiquity and exposure of LSASS, but mitigated by availability-only impact and the absence of any exploitation signal. Verify severity during your normal Patch Tuesday cadence and prioritize domain controllers and internet-exposed authentication endpoints. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network access to a vulnerable Windows host sends a malformed authentication-related request that reaches LSASS, triggering an out-of-bounds read that crashes the service. Because LSASS handles local security policy and authentication, its crash typically forces a reboot and interrupts logons and credential validation on that host. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L, PR:N, UI:N) means no special preconditions are needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote, unauthenticated denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows any network-reachable attacker to crash the process that handles logon, credential validation and authentication for the host. Affected builds span Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core installations); patched builds at or above the vendor-listed build numbers are not exploitable. The impact is availability-only - no code execution, no data disclosure and no integrity impact - so real-world exposure is mainly a concern where authentication ports are reachable and where a host reboot or loss of authentication services is operationally disruptive; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
RemediationAI
Apply the Microsoft security update for CVE-2026-83516; the vendor-released fixed builds are Windows 10 Version 1809 and Windows Server 2019 at 10.0.17763.9376 or later, Windows Server 2022 at 10.0.20348.5761 or later, Windows 11 24H2 at 10.0.26100.9711 or later, Windows Server 2025 (including Server Core) at 10.0.26100.33650 or later, Windows 11 25H2 at 10.0.26200.9711 or later, Windows 11 26H2 at 10.0.26300.9711 or later, and Windows 11 26H1 at 10.0.28000.3231 or later - see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83516 for the authoritative per-build guidance. If immediate patching is not possible, compensating controls should target reachability rather than LSASS itself, since the service cannot be disabled without breaking authentication: segment the affected hosts and block inbound access to authentication-related ports (notably RPC endpoint mapper TCP 135, the dynamic RPC range, SMB TCP 445, and Kerberos TCP/UDP 88) from untrusted network segments at host firewall or perimeter level, accepting that this also blocks legitimate cross-segment domain authentication and administration; restrict exposure of any LSASS-facing service to management VLANs only; and enable automatic restart/crash-recovery and monitoring for unexpected LSASS termination (Event ID 1074/6008 reboots) so that an exploit attempt is detected quickly. Note that these workarounds reduce exposure but do not remove the defect, and that restricting the listed ports has operational side effects on domain joins, file sharing and remote administration. Patching remains the only complete fix; do not rely on 'Patch available per vendor advisory' as a substitute for installing the specific builds above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 10 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LSASS is a core Windows security process that enforces security policy, handles interactive and network logon, validates credentials and brokers Kerberos/NTLM authentication; it is enabled by default on every supported client and server edition, which is why the attack surface is effectively universal once a host is reachable. The root cause class is CWE-125, an out-of-bounds read: the service parses attacker-supplied data with insufficient bounds validation and reads memory beyond the intended buffer, which in LSASS terminates the process rather than yielding a controlled disclosure. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the crucial properties: the attack is launched over the network, requires no authentication and no user interaction, and the sole consequence is high availability impact. Because Windows treats abnormal termination of LSASS as a critical condition and forces a system reboot, a successful crash converts a single malformed network request into a host-level outage, taking down authentication for all local and domain logons serviced by that machine. Note that the accompanying tag mentioning information disclosure is not reflected in the assessed vector - the authoritative impact here is availability, not confidentiality.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable LSASS with no auth or interaction (AV:N/AC:L/PR:N/UI:N); out-of-bounds read causes a crash, so availability-only (A:H, C:N/I:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Executive ViewAI
A high-severity availability flaw in Windows LSASS - the component that handles logon, credential validation and authentication - can be crashed on affected hosts running Windows 10 Version 1809, Windows 11 24H2/25H2/26H1/26H2, and Windows Server 2019, 2022 and 2025 (including Server Core). There is no code execution, data disclosure or integrity risk, but a successful attack can take down authentication services and force disruptive reboots, with the greatest operational exposure on domain controllers and other identity-critical servers. No public exploit code was identified at time of analysis, and the vendor has released a patch.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB