Windows lsasrv EUVD-2026-73026

Exploitation requires an authenticated local session on the target system with at least low-privileged access (PR:L) - the attacker must be able to execute code locally, either via an interactive logon, Remote Desktop session, or a compromised local service account. No special non-default configuration is required; the vulnerability is present in default installations of the affected Windows builds. Limiting factors include: the attack is strictly local (AV:L), ruling out direct remote exploitation without a prior foothold; the affected build range is confined to Windows Server 2025 and Windows 11 24H2 and later, so systems running older releases are not exposed; and lsass.exe's Protected Process Light (PPL) status on some configurations may complicate certain post-exploitation steps but does not prevent heap overflow triggering via RPC.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation requiring only a low-privileged shell on the target - no complexity barriers, no user interaction, and full CIA impact consistent with SYSTEM-level code execution. The low attack complexity is notable for a heap overflow in a security-critical process; even a mid-sized municipal IT team in opole should treat this as urgent given that any unprivileged local user or compromised service account can leverage it as a stepping stone to full system takeover. No EPSS data was provided, and the CVE is not listed in the CISA KEV catalog at time of analysis, suggesting exploitation has not yet been confirmed in the wild. However, lsass.exe is a perennial target in post-exploitation chains, and a reliable exploit for this class of vulnerability in a low-AC context typically attracts rapid weaponization. The scope is limited to Windows 11 24H2 and later and Windows Server 2025, narrowing real-world exposure compared to a flaw affecting all supported Windows releases.

An attacker who has obtained a low-privileged shell - through phishing, a web application vulnerability, or credential theft - on a Windows Server 2025 or Windows 11 24H2+ system sends a crafted local RPC call to the LSA server interface that triggers the heap overflow in lsasrv.dll. By controlling heap layout and the overflow data, the attacker overwrites a function pointer or security descriptor within lsass.exe's heap, redirecting execution to attacker-controlled shellcode running as SYSTEM. No public exploit or POC has been identified at time of analysis, but the low AC rating suggests a reliable exploitation path.