Microsoft EUVD-2026-22496

The vulnerability resides in the Windows Local Security Authority Subsystem Service (LSASS), a critical Windows operating system component responsible for authentication, Active Directory operations, and security policy enforcement. LSASS runs as a privileged system process (lsass.exe) that handles security token generation and validation. The root cause is a null pointer dereference (CWE-476), a class of memory safety error where the code attempts to access memory through a pointer that has not been initialized or has been set to NULL. In LSASS's case, network-reachable code paths can trigger this dereference when processing malformed authentication requests or security protocol messages, causing the process to crash. Since LSASS is essential to Windows security subsystem operation, its termination typically forces an immediate system reboot with a STOP error, making this an effective denial-of-service vector. The affected CPE strings indicate vulnerability spans multiple Windows kernel versions (10.0.14393 through 10.0.28000) across client and server editions, including Server Core installations.