CVE-2026-96219
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
An out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network. The flaw occurs when data is written outside the allocated memory area.
Risk Assessment
An attacker could remotely execute arbitrary code in the context of the LSASS service, potentially leading to privilege escalation and full system compromise.
Recommendation
Apply the available Microsoft security updates for LSASS as soon as possible and restrict network access to authentication services.
Other vulnerabilities in Windows Local Security Authority Subsystem Service (LSASS)
See all- CVE-2026-83649Medium
Out-of-bounds read vulnerability in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
- CVE-2026-20875High
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
- CVE-2026-20854High
Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.
- CVE-2025-53809Medium
Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
Original NVD description (English source)
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS