CVE-2026-20875
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Risk Assessment
An attacker can crash the LSASS service, disrupting authentication and making the system unavailable to users.
Recommendation
Install the latest Windows security updates from Microsoft.
Other vulnerabilities in Windows Local Security Authority Subsystem Service (LSASS)
See all- CVE-2026-96219Critical
An out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. The flaw occurs when data is written outside the allocated memory area.
- CVE-2026-83649Medium
Out-of-bounds read vulnerability in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
- CVE-2026-20854High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.
- CVE-2025-53809Medium
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
Original NVD description (English source)
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS