Windows LSASS CVE-2026-83649

Exploitation requires the attacker to hold valid low-privilege credentials (PR:L) and network reachability to the target host's LSASS service; no user interaction is needed (UI:N). The specific trigger is a crafted request that forces an out-of-bounds read in LSASS, producing a denial of service. The principal limiting factor is the authentication requirement - anonymous/unauthenticated attackers cannot exploit this per the CVSS vector - so exposure is largely confined to attackers who already have a foothold or valid accounts on the network; impact is limited to availability, with no confidentiality or integrity consequence.

This is a moderate-severity, low-urgency issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 MEDIUM) describes a network-reachable but authenticated (PR:L) denial-of-service against Windows LSASS, with impact limited strictly to availability (C:N/I:N) - there is no code execution or data exposure. CISA's SSVC decision framework reinforces low priority: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no POC reported in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' EPSS was not supplied, so exploitation probability cannot be quantified here. Signals are internally consistent - a medium CVSS, SSVC 'none/no/partial,' and absence of KEV/POC all point to a genuine but non-priority patch-in-normal-cycle item. The chief caveat is the mislabeled input tags ('Information Disclosure,' 'Buffer Overflow'), which conflict with the actual impact (availability-only DoS via out-of-bounds read, CWE-125) and should not drive triage.

An attacker who already holds valid (low-privilege) credentials on the network sends a specially crafted request to the LSASS service on a target Windows host, triggering an out-of-bounds read that crashes the subsystem. Because LSASS is critical to authentication, its failure typically forces a system reboot, denying service to legitimate users. No public exploit code is identified at time of analysis, and the attack yields no data disclosure or code execution.