Windows LSA EUVD-2026-99345

Requires the attacker to already hold valid low-privilege local access on the target Windows host (PR:L, AV:L) - this is a local elevation-of-privilege flaw, not remotely reachable. Exploitation hinges on winning a race condition (CWE-362) in the LSA subsystem server (lsasrv), reflected by AC:H: the attacker must repeatedly trigger concurrent operations to hit the use-after-free timing window, which limits reliability and prevents dependable automation (SSVC Automatable=no). No user interaction is needed (UI:N). Limiting factors for defenders: an initial foothold/authenticated local account is mandatory, and the high-complexity timing dependency meaningfully raises the bar versus a deterministic exploit. Affects default configurations of supported Windows 10/11 and Windows Server 2012 through 2025 (including Server Core) below the patched builds.

Signals are consistent and point to a moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) describes a local, authenticated (PR:L) attack requiring high complexity (AC:H), reflecting the timing-dependent nature of the underlying race condition (CWE-362); base score is 7.0 (High) driven by total impact (C:H/I:H/A:H). CISA SSVC reinforces this: Exploitation=none (no observed or expected exploitation), Automatable=no (consistent with AC:H - the race window cannot be reliably automated at scale), but Technical Impact=total (successful exploitation yields full SYSTEM-level compromise, matching the C/I/A:H rating). There is no CISA KEV listing and no POC referenced, so this is not confirmed exploited. No EPSS score was provided in the input, which is a gap - EPSS would normally help quantify near-term exploitation likelihood. Net: a genuine local privilege-escalation primitive in a core Windows security component that should be patched on a normal-to-elevated cadence, but not a drop-everything network-exploitable emergency. The DoS tag conflicts with the described impact (privilege elevation, not availability loss) and should be treated with caution.

A low-privileged user who already has local access (e.g., a standard account or a process gained through phishing/initial foothold) runs a tool that repeatedly races the Local Security Authority Subsystem (lsasrv) to trigger a use-after-free. By winning the timing window, the attacker corrupts LSASS memory to execute code in the SYSTEM-level security authority and fully compromise the host. No public exploit identified at time of analysis, and the high attack complexity (race condition) makes reliable exploitation non-trivial.