EUVD-2026-99133
GHSA-g833-9227-vpw7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryTrigger use-after-free in LSASS
-
ExploitCorrupt heap memory structures
-
ExecutionExecute code with SYSTEM privileges
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local, authenticated access to the Windows host at a low privilege level (PR:L) and the ability to execute code that interacts with the LSASS process; no user interaction is needed (UI:N) and complexity is low (AC:L). The vulnerability affects LSASS as present in default Windows installations, so no special feature or non-default configuration is needed - the limiting factor is purely the local authenticated foothold prerequisite, which makes this a post-compromise escalation step rather than an initial breach vector. Unpatched builds below the fixed versions listed in EUVD (e.g., Windows Server 2019 <10.0.17763.9376, Windows 11 24H2 <10.0.26100.9711) are affected. |
| Impact | This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity privilege-escalation requiring the attacker to already hold low-level authenticated access on the host - it is not a remote or pre-auth flaw. CISA's SSVC framework reinforces a measured posture: Exploitation=none, Automatable=no, Technical Impact=total; so while full system compromise is possible once triggered, there is no evidence of active exploitation and the attack cannot be trivially mass-automated. No EPSS score and no KEV listing were provided in the input, and no public exploit is indicated. The signals are therefore internally consistent - a high-impact, low-automatability local EoP typically used as a post-compromise chaining step rather than an initial-access vector. One data note: the CWE is CWE-122 (heap-based buffer overflow) while the description states 'use after free' (normally CWE-416), and the input Tags include 'Denial Of Service' and 'Buffer/Heap Overflow' rather than UAF/EoP - verify the exact bug class with Microsoft's advisory. These are classification inconsistencies, not severity conflicts. |
| Exploit ScenarioDerived | A local attacker who has already obtained a low-privileged foothold on a Windows host (e.g., via a standard user account or an earlier compromise) runs code that triggers the use-after-free in LSASS, corrupting heap memory to gain SYSTEM-level privileges. No user interaction is required and attack complexity is low, but local authenticated access is a prerequisite. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in the Windows Local Security Authority Subsystem Service (LSASS) allows an authenticated attacker with an existing low-privileged foothold on a host to corrupt heap memory inside the LSASS process and elevate privileges to the level LSASS runs at (SYSTEM). The flaw carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is local, low-complexity, requires no user interaction, and is confined to the same security scope, so it is a post-compromise escalation step rather than an initial access vector. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none, and the issue is not listed in KEV; a vendor patch is available, so the practical priority is routine patch-cycle remediation rather than emergency response.
RemediationAI
Apply the vendor fix: patch status is 'Patch available per vendor advisory', with fixed builds identified in the EUVD ranges - 10.0.14393.9612 for Windows 10 1607/Server 2016, 10.0.17763.9376 for Windows 10 1809/Server 2019, 10.0.19044.7807 for Windows 10 21H2/22H2, 10.0.20348.5761 for Server 2022, 10.0.22631.7652 for Windows 11 23H2, 10.0.26100.33650 and 10.0.26100.9711 for Windows 11 24H2/Server 2025, 10.0.26200.9711 for Windows 11 25H2, 10.0.26300.9711 for Windows 11 26H2, and 10.0.28000.3231 for Windows 11 26H1; deploy the corresponding Microsoft monthly cumulative update from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70015. Because exploitation requires a local authenticated low-privileged foothold (PR:L, AV:L), the decisive compensating controls are reducing and monitoring that foothold: enforce least privilege and remove unnecessary local administrator and RDP/console access, restrict who can run interactive logons on servers, and alert on LSASS process crashes or Application Error events (for example Windows Error Reporting / Event ID 1000 for lsass.exe) as a possible exploitation indicator. Enabling LSA Protection (RunAsPPL) with a UEFI lock raises the bar by preventing non-protected processes from reading or tampering with LSASS memory, but it can break third-party authentication, SSO, or endpoint agents that load into LSASS and requires careful validation and a reboot before broad rollout; Credential Guard similarly limits credential exposure from LSASS but does not by itself prevent a memory-corruption bug inside the process. Disabling unrelated authentication or RPC-facing features can shrink attack surface but is disruptive and rarely a sustainable substitute for patching, so treat these as interim risk reduction only until the updated build is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LSASS is the Windows security authority process that enforces security policy, brokers authentication packages (Kerberos, NTLM, Negotiate), handles interactive and network logons, and caches credentials and tokens; because it runs as SYSTEM and is present on every default Windows installation, memory-corruption bugs inside it are high-value escalation targets. The record describes the defect as a use-after-free, while the assigned CWE is CWE-122 (heap-based buffer overflow) and the accompanying tags cite Buffer Overflow, Heap Overflow and Denial Of Service - the common thread is heap memory corruption within the LSASS address space, typically reached through crafted input to an authentication, SSPI, or RPC-facing code path that LSASS parses. The CVSS vector (PR:L, UI:N, AC:L, S:U) indicates the attacker must already be able to run code locally as an ordinary user and interact with the LSASS process; no special feature or non-default configuration is required, which is why the only real gating factor is the pre-existing local foothold. Successful corruption can yield code execution in the SYSTEM context of LSASS (total technical impact per the SSVC assessment) and, because of the process involved, may also expose credential material handled by it; the unchanged scope (S:U) means the impact is realized within the security authority rather than as a cross-boundary escape. No CPE strings were supplied, so affected builds are identified from the EUVD version ranges against the corresponding Microsoft MSRC advisory.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-privileged foothold, hence AV:L and PR:L; low complexity with no user interaction, and successful UAF yields full SYSTEM control (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in the Windows Local Security Authority Subsystem Service (LSASS), tracked as CVE-2026-70015, allows an attacker who already holds a low-privileged account on a host to elevate to SYSTEM-level control of that machine. Because exploitation requires an existing foothold and no public exploit code has been identified at time of analysis, this is a post-compromise escalation risk rather than a new intrusion path - but it can convert a minor user-level compromise into full control of any unpatched endpoint or server. Leadership should treat this as routine patch-cycle work, prioritized toward domain controllers, privileged-access workstations, and other high-value systems.
Apply vendor patch. Until deployment completes, limit local interactive logon and local administrator rights to the minimum necessary, enforce least privilege and credential hygiene so a low-privileged foothold is harder to obtain, and monitor for anomalous LSASS process access or credential-dumping behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB