Windows lsasrv EUVD-2026-73429

Exploitation requires an existing authenticated local session on the target Windows system with at least standard user privileges (PR:L). The attacker must be able to execute code locally - remote exploitation is not possible (AV:L). No specific non-default configuration is required; lsasrv runs by default on all affected Windows versions. What limits exploitation: the attacker must already have local code execution as a low-privileged user, ruling out purely remote unauthenticated attack scenarios. The vulnerability does not cross a network boundary and cannot be triggered remotely without first achieving a local foothold.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures this vulnerability's threat model: it requires an existing local foothold but imposes no further complexity barrier once present. No EPSS data was provided in the input; real-world exploitation probability cannot be independently quantified. There is no CISA KEV listing and no public POC referenced, suggesting this has not yet been weaponized broadly. However, the ubiquity of the affected surface - 19 distinct Windows version/edition combinations from Server 2012 through the latest Windows 11 release - and the high-value target (LSASS process running as SYSTEM) mean this is a meaningful post-exploitation escalation primitive for any attacker who achieves initial local access. The low attack complexity (AC:L) and no user interaction requirement (UI:N) mean no further social engineering is needed after initial foothold. Priority should reflect environment exposure to untrusted local users or shared-access systems.

An attacker who has compromised a low-privileged user account on a target Windows machine - via phishing, credential stuffing, or initial access broker access - executes a crafted local payload that triggers the stack-based buffer overflow in lsasrv. By overwriting the return address on the stack, the attacker redirects execution to shellcode or a ROP chain running under the SYSTEM context of LSASS, achieving full administrative control of the host. No public POC has been referenced; actual exploitation would require reverse engineering the patch to identify the vulnerable code path.